feat: portal redesign, pricing catalog, partner-staff invites

- portal: new admin/ and partner/ surfaces with full component library
  (AppLauncher, Avatar, Badge, Card, Modal, Tabs, etc.), composables,
  layouts, partner-routing middleware, and supporting server APIs
- pricing: Price schema/module with operator CRUD, pricing.vue catalog UI,
  Subscription extended with cycle/currency/perSeatAmount/seats snapshots
  for stable MRR aggregation
- partner staff: User.partnerId, invite-partner-user DTO and flow,
  /partners/:slug/users endpoints, InvitePartnerUserModal, shared
  dezky-partner-staff Authentik group
- /me: partner-aware endpoint returning user + partner context so portal
  can route between end-user and partner-admin surfaces
- tenant: seats field for portfolio displays and future MRR calculations
- operator: pricing page, signed-out page, useMe/useToast composables,
  ToastStack

services/platform-api/src/prices/prices.controller.ts

@@ -0,0 +1,38 @@
+import { Body, Controller, Delete, Get, Param, Patch, Post, Query, UseGuards } from '@nestjs/common'
+import { JwtAuthGuard } from '../auth/jwt-auth.guard.js'
+import { OperatorGuard } from '../auth/operator.guard.js'
+import { CreatePriceDto } from './dto/create-price.dto.js'
+import { UpdatePriceDto } from './dto/update-price.dto.js'
+import { PricesService } from './prices.service.js'
+
+// All endpoints require an authenticated caller. Read is open to any
+// authenticated JWT (partners + portal users see prices for display);
+// write operations layer the OperatorGuard on top.
+@Controller('prices')
+@UseGuards(JwtAuthGuard)
+export class PricesController {
+  constructor(private readonly prices: PricesService) {}
+
+  @Get()
+  list(@Query('includeInactive') includeInactive?: string) {
+    return this.prices.findAll(includeInactive === 'true')
+  }
+
+  @Post()
+  @UseGuards(OperatorGuard)
+  create(@Body() dto: CreatePriceDto) {
+    return this.prices.create(dto)
+  }
+
+  @Patch(':id')
+  @UseGuards(OperatorGuard)
+  update(@Param('id') id: string, @Body() dto: UpdatePriceDto) {
+    return this.prices.update(id, dto)
+  }
+
+  @Delete(':id')
+  @UseGuards(OperatorGuard)
+  deactivate(@Param('id') id: string) {
+    return this.prices.deactivate(id)
+  }
+}