feat: portal redesign, pricing catalog, partner-staff invites

- portal: new admin/ and partner/ surfaces with full component library
  (AppLauncher, Avatar, Badge, Card, Modal, Tabs, etc.), composables,
  layouts, partner-routing middleware, and supporting server APIs
- pricing: Price schema/module with operator CRUD, pricing.vue catalog UI,
  Subscription extended with cycle/currency/perSeatAmount/seats snapshots
  for stable MRR aggregation
- partner staff: User.partnerId, invite-partner-user DTO and flow,
  /partners/:slug/users endpoints, InvitePartnerUserModal, shared
  dezky-partner-staff Authentik group
- /me: partner-aware endpoint returning user + partner context so portal
  can route between end-user and partner-admin surfaces
- tenant: seats field for portfolio displays and future MRR calculations
- operator: pricing page, signed-out page, useMe/useToast composables,
  ToastStack

apps/portal/middleware/partner-routing.global.ts

@@ -0,0 +1,25 @@
+// Routes signed-in users to the surface that matches their role:
+//   - partner staff (User.partnerId set) on '/' → /partner
+//   - non-partner-staff hitting /partner/* → /
+//
+// Runs after the OIDC global middleware (00.auth.global from nuxt-oidc-auth)
+// so we know the user is authenticated by the time we get here. /me is
+// fetched lazily via useMe() and cached in useState — first nav after sign-in
+// pays one round-trip, subsequent navs read from cache.
+//
+// Auth pages (/auth/*, /signed-out) are skipped because they're public.
+
+export default defineNuxtRouteMiddleware(async (to) => {
+  if (to.path.startsWith('/auth/') || to.path === '/signed-out') return
+
+  const { fetchMe, isPartnerStaff } = useMe()
+  const me = await fetchMe()
+  if (!me) return  // Not signed in yet — OIDC middleware handles the bounce
+
+  if (to.path === '/' && isPartnerStaff.value) {
+    return navigateTo('/partner')
+  }
+  if (to.path.startsWith('/partner') && !isPartnerStaff.value) {
+    return navigateTo('/')
+  }
+})