feat(portal): customer-admin surface on real data + Stripe billing + session resilience

Access & navigation
- Gate partner-mode strictly to partner staff so admins/end-users never inherit
  leftover partner-view state; purge stale session entry on hydrate.
- Role-driven admin entry: useMe.isTenantAdmin, Admin/Personal tiles in the app
  launcher, and an /admin route guard in the global middleware (fail closed).
- Drop the duplicate user identity block from the sidebar footer.

Admin pages on real data
- New tenant-scoped, membership-gated endpoints: GET /tenants/:slug/{audit,users,
  invoices}; useTenant composable resolves the active workspace + subscription.
- Dashboard: real seats, spend (cycle-normalized + minor-units), plan, renewal,
  and recent audit; unbacked sections removed.
- Users & groups: real members; Groups/Invitations/Service accounts shown as
  honest "coming soon".
- Subscription & invoices: real plan hero, invoice history, and billing details.

Stripe payment method (Elements + SetupIntent)
- StripeClient: publishable key + getDefaultCard/createSetupIntent/setDefaultCard.
- CustomerBillingController + BillingService methods (ensure-customer on demand).
- Portal: PaymentMethodModal, useStripeJs (CDN load), proxies; hidePostalCode.

Editable billing details & whitelabel branding
- PATCH /tenants/:slug/billing-info (narrow: company/VAT/country/email).
- TenantBranding schema/service + GET/PUT /tenants/:slug/branding: real product
  name, accent colour, and per-tenant email-template overrides.
- Branding preview + sidebar workspace mark wired to real name/plan/seats/colour
  with YIQ auto-contrast (readableOn util).

Session resilience
- Request offline_access so Authentik issues a refresh token (automaticRefresh).
- Silent refresh + single retry on 401 for writes (useApiFetch, incl. partner
  pages) and reads (useMe.fetchMe) — no redirect, no lost input.
- Modal backdrop closes only on press+release on the backdrop (no more
  drag-select-to-close).

apps/portal/composables/usePartnerMode.ts

@@ -10,6 +10,13 @@
 const activeCustomerId = ref<string | null>(null)
 
 export const usePartnerMode = () => {
+  // Partner mode is only ever meaningful for partner staff. The active-customer
+  // id lives in sessionStorage, which is shared across whoever signs in on this
+  // device — so an admin or end-user could otherwise inherit a partner's leftover
+  // state and see partner-view chrome. We gate every read on isPartnerStaff so
+  // that can never happen, regardless of what's stored.
+  const { isPartnerStaff } = useMe()
+
   function enter(customerId: string) {
     activeCustomerId.value = customerId
     if (import.meta.client) {
@@ -23,13 +30,23 @@ export const usePartnerMode = () => {
     }
   }
   function hydrate() {
-    if (!import.meta.client || activeCustomerId.value) return
+    if (!import.meta.client) return
+    // Non-partner accounts must never be in partner mode. Purge any stale
+    // entry left by a previous partner session on this same device.
+    if (!isPartnerStaff.value) {
+      sessionStorage.removeItem('dezky-partner-active-customer')
+      activeCustomerId.value = null
+      return
+    }
+    if (activeCustomerId.value) return
     const stored = sessionStorage.getItem('dezky-partner-active-customer')
     if (stored) activeCustomerId.value = stored
   }
   return {
     activeCustomerId,
-    isActive: computed(() => activeCustomerId.value !== null),
+    isActive: computed(
+      () => isPartnerStaff.value && activeCustomerId.value !== null,
+    ),
     enter,
     exit,
     hydrate,