feat(operator): show per-tenant role in tenant users list

GET /tenants/:slug/users now returns a tenant-scoped `tenantRole`
(resolved server-side via roleForTenant), and the operator tenant page
displays it instead of the global `role` — so a user who is admin here
but member elsewhere reads correctly in this tenant's context. The
global `role` field is kept intact for other consumers.

apps/operator/pages/tenants/[slug].vue

@@ -203,7 +203,7 @@ async function reconcile() {
                 </td>
                 <td>
                   <Badge :tone="u.platformAdmin ? 'accent' : 'neutral'">
-                    {{ u.platformAdmin ? 'platform-admin' : u.role }}
+                    {{ u.platformAdmin ? 'platform-admin' : u.tenantRole }}
                   </Badge>
                 </td>
                 <td>