feat: partner enrichment, mutations, settings & branding + operator quick-wins

Backend (platform-api): computed tenant health plus industry/brandColor; partner-scoped tenant update/suspend/resume guarded by assertPartnerOwnsTenant; enriched partner users (MFA + access level) with invite/remove; partner settings and whitelabel branding persistence; Authentik authenticator counting and group removal. Audit on every mutation.

Frontend (portal): all five partner pages on real data — dashboard alerts, customers edit/suspend, team MFA/access with invite/remove, editable settings, branding fetch/save.

Operator: dashboard and infrastructure service health driven by real liveness probes; fabricated uptime/p95/error-rate removed.

services/platform-api/src/schemas/tenant.schema.ts

@@ -37,6 +37,16 @@ export class Tenant {
   @Prop({ type: [String], default: [] })
   domains!: string[]
 
+  // Partner-editable customer metadata. Display-only — not used for
+  // provisioning. `industry` is free text; `brandColor` is a #rrggbb hex
+  // (validated at the DTO layer) rendered as the customer's swatch in the
+  // partner portal.
+  @Prop({ trim: true })
+  industry?: string
+
+  @Prop({ trim: true })
+  brandColor?: string
+
   // Optional MSP/reseller this tenant belongs to. Sparse — direct tenants have none.
   @Prop({ type: Types.ObjectId, ref: 'Partner', index: true, sparse: true })
   partnerId?: Types.ObjectId