feat: portal redesign, pricing catalog, partner-staff invites

- portal: new admin/ and partner/ surfaces with full component library
  (AppLauncher, Avatar, Badge, Card, Modal, Tabs, etc.), composables,
  layouts, partner-routing middleware, and supporting server APIs
- pricing: Price schema/module with operator CRUD, pricing.vue catalog UI,
  Subscription extended with cycle/currency/perSeatAmount/seats snapshots
  for stable MRR aggregation
- partner staff: User.partnerId, invite-partner-user DTO and flow,
  /partners/:slug/users endpoints, InvitePartnerUserModal, shared
  dezky-partner-staff Authentik group
- /me: partner-aware endpoint returning user + partner context so portal
  can route between end-user and partner-admin surfaces
- tenant: seats field for portfolio displays and future MRR calculations
- operator: pricing page, signed-out page, useMe/useToast composables,
  ToastStack

apps/operator/components/UserMenu.vue

@@ -4,7 +4,7 @@
 // outside-click + Escape + route-change dismissal so the parent topbar stays
 // dumb.
 
-const { user, logout } = useOidcAuth()
+const { user } = useOidcAuth()
 const { state: tweaks, setTheme } = useTweaks()
 const route = useRoute()
 
@@ -25,7 +25,11 @@ function flipTheme() {
 
 async function signOut() {
   close()
-  await logout()
+  // Use our custom endpoint instead of useOidcAuth().logout() — see
+  // apps/operator/server/api/auth/sign-out.get.ts. It ends BOTH the local
+  // session and the Authentik IdP session (required for shared-workstation
+  // safety on an elevated-privilege portal) and lands on /signed-out.
+  await navigateTo('/api/auth/sign-out', { external: true })
 }
 
 watch(() => route.path, close)