feat: portal redesign, pricing catalog, partner-staff invites

- portal: new admin/ and partner/ surfaces with full component library
  (AppLauncher, Avatar, Badge, Card, Modal, Tabs, etc.), composables,
  layouts, partner-routing middleware, and supporting server APIs
- pricing: Price schema/module with operator CRUD, pricing.vue catalog UI,
  Subscription extended with cycle/currency/perSeatAmount/seats snapshots
  for stable MRR aggregation
- partner staff: User.partnerId, invite-partner-user DTO and flow,
  /partners/:slug/users endpoints, InvitePartnerUserModal, shared
  dezky-partner-staff Authentik group
- /me: partner-aware endpoint returning user + partner context so portal
  can route between end-user and partner-admin surfaces
- tenant: seats field for portfolio displays and future MRR calculations
- operator: pricing page, signed-out page, useMe/useToast composables,
  ToastStack

services/platform-api/src/partners/partners.controller.ts

@@ -17,6 +17,8 @@ import { JwtAuthGuard } from '../auth/jwt-auth.guard.js'
 import { OperatorGuard } from '../auth/operator.guard.js'
 import type { AuthentikJwtPayload } from '../auth/jwt-payload.interface.js'
 import type { AuditActor } from '../audit/audit.service.js'
+import { InvitePartnerUserDto } from '../users/dto/invite-partner-user.dto.js'
+import { UsersService } from '../users/users.service.js'
 import { CreatePartnerDto } from './dto/create-partner.dto.js'
 import { UpdatePartnerDto } from './dto/update-partner.dto.js'
 import { PartnersService } from './partners.service.js'
@@ -42,6 +44,7 @@ function auditActor(
 export class PartnersController {
   constructor(
     private readonly partners: PartnersService,
+    private readonly users: UsersService,
     private readonly actorService: ActorService,
   ) {}
 
@@ -93,4 +96,31 @@ export class PartnersController {
     const user = await this.actorService.resolve(jwt)
     await this.partners.terminate(slug, auditActor(user, req))
   }
+
+  // Partner-staff team listing. Returns the User docs whose partnerId matches
+  // this partner. The /partners/:slug page's Team section calls this on load.
+  @Get(':slug/users')
+  async listUsers(@Param('slug') slug: string) {
+    const partner = await this.partners.findOneBySlug(slug)
+    return this.users.listPartnerUsers(partner._id)
+  }
+
+  // Invite a new partner-staff user. Resolves slug → partner, delegates to
+  // UsersService.invitePartnerUser which handles Authentik user creation,
+  // group assignment, local User pre-create, and audit recording.
+  @Post(':slug/users')
+  async inviteUser(
+    @Param('slug') slug: string,
+    @Body() dto: InvitePartnerUserDto,
+    @CurrentUser() jwt: AuthentikJwtPayload,
+    @Req() req: Parameters<typeof clientIp>[0],
+  ) {
+    const actor = await this.actorService.resolve(jwt)
+    const partner = await this.partners.findOneBySlug(slug)
+    return this.users.invitePartnerUser(
+      dto,
+      { _id: partner._id, slug: partner.slug },
+      auditActor(actor, req),
+    )
+  }
 }