feat: portal redesign, pricing catalog, partner-staff invites

- portal: new admin/ and partner/ surfaces with full component library
  (AppLauncher, Avatar, Badge, Card, Modal, Tabs, etc.), composables,
  layouts, partner-routing middleware, and supporting server APIs
- pricing: Price schema/module with operator CRUD, pricing.vue catalog UI,
  Subscription extended with cycle/currency/perSeatAmount/seats snapshots
  for stable MRR aggregation
- partner staff: User.partnerId, invite-partner-user DTO and flow,
  /partners/:slug/users endpoints, InvitePartnerUserModal, shared
  dezky-partner-staff Authentik group
- /me: partner-aware endpoint returning user + partner context so portal
  can route between end-user and partner-admin surfaces
- tenant: seats field for portfolio displays and future MRR calculations
- operator: pricing page, signed-out page, useMe/useToast composables,
  ToastStack

apps/portal/pages/signed-out.vue

@@ -0,0 +1,57 @@
+<script setup lang="ts">
+// Sign-out landing. /api/auth/sign-out cleared the local session and bounced
+// through Authentik's end-session endpoint, which ended the IdP session.
+// At this point the user has no portal session and no Authentik session —
+// visiting / will prompt for fresh credentials. (The hidden iframe trick is
+// no longer needed; full redirect through Authentik handles everything.)
+
+definePageMeta({ layout: 'blank', auth: false, oidcAuth: { enabled: false } })
+
+function signInAgain() {
+  // External navigation so the OIDC handler runs on the server and issues
+  // the meta-refresh into Authentik's authorize URL. router.push('/') would
+  // bounce through /auth/login first, adding an extra hop.
+  return navigateTo('/auth/oidc/login', { external: true })
+}
+</script>
+
+<template>
+  <AuthShell>
+    <div class="badge">
+      <UiIcon name="check" :size="28" />
+    </div>
+    <AuthHeading
+      eyebrow="See you soon"
+      title="You're signed out"
+      body="Your session has been ended. Sign in again whenever you're ready — your work is right where you left it."
+    />
+
+    <AuthButton variant="primary" @click="signInAgain">Sign in again</AuthButton>
+
+    <AuthFooterLink>
+      Closing the tab? Your data stays put on
+      <span class="mono">app.dezky.local</span>.
+    </AuthFooterLink>
+  </AuthShell>
+</template>
+
+<style scoped>
+.badge {
+  width: 56px;
+  height: 56px;
+  border-radius: 14px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  margin: 0 0 18px 0;
+  background: rgba(31, 138, 91, 0.1);
+  color: var(--ok);
+}
+
+.mono {
+  font-family: var(--font-mono);
+  font-size: 11px;
+  color: var(--text-dim);
+}
+
+</style>