feat: portal redesign, pricing catalog, partner-staff invites

- portal: new admin/ and partner/ surfaces with full component library
  (AppLauncher, Avatar, Badge, Card, Modal, Tabs, etc.), composables,
  layouts, partner-routing middleware, and supporting server APIs
- pricing: Price schema/module with operator CRUD, pricing.vue catalog UI,
  Subscription extended with cycle/currency/perSeatAmount/seats snapshots
  for stable MRR aggregation
- partner staff: User.partnerId, invite-partner-user DTO and flow,
  /partners/:slug/users endpoints, InvitePartnerUserModal, shared
  dezky-partner-staff Authentik group
- /me: partner-aware endpoint returning user + partner context so portal
  can route between end-user and partner-admin surfaces
- tenant: seats field for portfolio displays and future MRR calculations
- operator: pricing page, signed-out page, useMe/useToast composables,
  ToastStack

apps/operator/components/OpSidebar.vue

@@ -24,6 +24,7 @@ const NAV: NavRow[] = [
   { id: 'users',     label: 'Users (global)',   icon: 'users',     href: '/users' },
   { id: 'support',   label: 'Support',          icon: 'help',      href: '/support' },
   { sec: 'Commercial' },
+  { id: 'pricing',   label: 'Pricing',          icon: 'card',      href: '/pricing' },
   { id: 'billing',   label: 'Platform billing', icon: 'card',      href: '/billing' },
   { id: 'reports',   label: 'Reports',          icon: 'database',  href: '/reports' },
   { sec: 'Operations' },