feat(operator): show per-tenant role in tenant users list

GET /tenants/:slug/users now returns a tenant-scoped `tenantRole`
(resolved server-side via roleForTenant), and the operator tenant page
displays it instead of the global `role` — so a user who is admin here
but member elsewhere reads correctly in this tenant's context. The
global `role` field is kept intact for other consumers.

apps/operator/pages/tenants/[slug].vue

@@ -203,7 +203,7 @@ async function reconcile() {
                 </td>
                 <td>
                   <Badge :tone="u.platformAdmin ? 'accent' : 'neutral'">
-                    {{ u.platformAdmin ? 'platform-admin' : u.role }}
+                    {{ u.platformAdmin ? 'platform-admin' : u.tenantRole }}
                   </Badge>
                 </td>
                 <td>

apps/operator/types/tenant.ts

@@ -41,7 +41,12 @@ export interface TenantUser {
   authentikSubjectId: string
   email: string
   name: string
+  // Global/legacy role + fallback. Prefer `tenantRole` for display in a tenant
+  // context — `role` can differ from the user's actual role in this tenant.
   role: 'owner' | 'admin' | 'member'
+  // Role resolved for THIS tenant (per-tenant override, else global `role`).
+  // Set by GET /tenants/:slug/users.
+  tenantRole: 'owner' | 'admin' | 'member'
   active: boolean
   platformAdmin: boolean
   tenantIds: string[]