feat: portal redesign, pricing catalog, partner-staff invites

- portal: new admin/ and partner/ surfaces with full component library
  (AppLauncher, Avatar, Badge, Card, Modal, Tabs, etc.), composables,
  layouts, partner-routing middleware, and supporting server APIs
- pricing: Price schema/module with operator CRUD, pricing.vue catalog UI,
  Subscription extended with cycle/currency/perSeatAmount/seats snapshots
  for stable MRR aggregation
- partner staff: User.partnerId, invite-partner-user DTO and flow,
  /partners/:slug/users endpoints, InvitePartnerUserModal, shared
  dezky-partner-staff Authentik group
- /me: partner-aware endpoint returning user + partner context so portal
  can route between end-user and partner-admin surfaces
- tenant: seats field for portfolio displays and future MRR calculations
- operator: pricing page, signed-out page, useMe/useToast composables,
  ToastStack

apps/portal/pages/auth/disabled.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-definePageMeta({ auth: false })
+definePageMeta({ auth: false, layout: 'blank' })
 
 const route = useRoute()
 const accountEmail = computed(() => (route.query.email as string) || 'this account')

apps/portal/pages/auth/expired.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-definePageMeta({ auth: false })
+definePageMeta({ auth: false, layout: 'blank' })
 
 async function signInAgain() {
   await navigateTo('/auth/oidc/login', { external: true })

apps/portal/pages/auth/login.vue

@@ -1,8 +1,9 @@
 <script setup lang="ts">
-// Custom login page (nuxt-oidc-auth customLoginPage=true means it won't auto-bounce).
-// We intercept the click and kick off the OIDC flow via the module's helper.
+// Interstitial login page. With customLoginPage:false in nuxt.config the
+// OIDC module's route rule auto-redirects /auth/login → /auth/oidc/login,
+// so this content rarely renders — it's a fallback for direct navigation.
 
-definePageMeta({ auth: false })
+definePageMeta({ auth: false, layout: 'blank' })
 
 const email = ref('')