feat: portal redesign, pricing catalog, partner-staff invites

- portal: new admin/ and partner/ surfaces with full component library
  (AppLauncher, Avatar, Badge, Card, Modal, Tabs, etc.), composables,
  layouts, partner-routing middleware, and supporting server APIs
- pricing: Price schema/module with operator CRUD, pricing.vue catalog UI,
  Subscription extended with cycle/currency/perSeatAmount/seats snapshots
  for stable MRR aggregation
- partner staff: User.partnerId, invite-partner-user DTO and flow,
  /partners/:slug/users endpoints, InvitePartnerUserModal, shared
  dezky-partner-staff Authentik group
- /me: partner-aware endpoint returning user + partner context so portal
  can route between end-user and partner-admin surfaces
- tenant: seats field for portfolio displays and future MRR calculations
- operator: pricing page, signed-out page, useMe/useToast composables,
  ToastStack

apps/operator/nuxt.config.ts

@@ -10,6 +10,17 @@ export default defineNuxtConfig({
 
   css: ['~/assets/styles/tokens.css', '~/assets/styles/base.css'],
 
+  // Auto-import from the shared packages/ui workspace in addition to the
+  // app's own components/. /shared-packages is bind-mounted in
+  // docker-compose.yml — outside containers the same files live at
+  // <repo>/packages/ui/components/. The local dir keeps the default
+  // directory-based prefix; the shared dir uses no prefix so
+  // CountrySelect.vue is just <CountrySelect>.
+  components: [
+    '~/components',
+    { path: '/shared-packages/ui/components', pathPrefix: false },
+  ],
+
   app: {
     head: {
       htmlAttrs: { 'data-theme': 'dark' },
@@ -55,6 +66,11 @@ export default defineNuxtConfig({
         pkce: true,
         skipAccessTokenParsing: true,
         exposeAccessToken: true,
+        // Also expose id_token so /api/auth/sign-out can pass it as
+        // id_token_hint to Authentik's end-session endpoint. Without it
+        // Authentik can't identify the session to terminate and falls back
+        // to its own "you've logged out" confirmation page.
+        exposeIdToken: true,
       },
     },
   },
@@ -74,5 +90,11 @@ export default defineNuxtConfig({
     routeRules: {
       '/api/**': { cors: true },
     },
+    // Persist nuxt-oidc-auth's session store on disk so HMR / dev-server
+    // restarts don't sign operators out. The default memory driver is fine
+    // in prod where one long-running container holds the state.
+    storage: {
+      oidc: { driver: 'fs', base: '.nuxt/oidc-store' },
+    },
   },
 })