feat(admin/users): editable member drawer + mailbox & ownership management

Rebuild the /admin/users detail drawer from a read-only profile into an
editable, Office 365-style panel with four sections:

- Username & mail: read-only primary for mailbox users; editable sign-in
  (Authentik-only) for mailbox-less identities; "Create mailbox" provisions
  a Stalwart inbox for an external-login admin
- Aliases: list/add/remove mailbox aliases (Stalwart), domain-scoped
- Role: member/admin toggle with a primary-account lock (owner, mailbox-less
  bootstrap admin, self) and a last-admin guard
- Contact information: display name, first/last name, phone, alternative
  email — mirrored best-effort to Authentik attributes + mailbox name

Ownership transfer: "Make owner" (row menu + drawer) plus an owner-side
"Transfer ownership" picker, gated to tenant admins / platform admins so a
departed owner can be replaced; promotes the target and demotes the prior
owner to admin.

Backend (platform-api): contact fields on User; AuthentikClient.updateUser;
StalwartClient.setMailboxName; UsersService updateTenantMember,
changeMemberPrimaryEmail, list/add/removeMemberAlias, createMailboxForMember,
transferOwnership; new DTOs and tenant-member routes. All mutations audited.

Portal: Nuxt proxies for the new endpoints + extended TenantUserDoc.

services/platform-api/src/users/dto/update-tenant-member.dto.ts

@@ -0,0 +1,43 @@
+import { IsEmail, IsIn, IsOptional, IsString, MaxLength, MinLength, ValidateIf } from 'class-validator'
+
+// Patch a workspace member's directory profile + in-tenant role. Every field is
+// optional — the drawer saves contact info and role independently, so a request
+// may carry just one section's worth. Empty strings are allowed (and clear the
+// field) for the free-text fields; alternativeEmail must be a valid email when
+// non-empty.
+export class UpdateTenantMemberDto {
+  @IsOptional()
+  @IsString()
+  @MinLength(1)
+  @MaxLength(120)
+  name?: string
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(80)
+  firstName?: string
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(80)
+  lastName?: string
+
+  @IsOptional()
+  @IsString()
+  @MaxLength(40)
+  phone?: string
+
+  // '' clears it; any other value must look like an email.
+  @IsOptional()
+  @ValidateIf((o) => o.alternativeEmail !== '')
+  @IsEmail()
+  @MaxLength(200)
+  alternativeEmail?: string
+
+  // In-tenant role only. Owner is intentionally excluded — ownership transfer
+  // is a separate, guarded flow; this section never promotes to / demotes from
+  // owner.
+  @IsOptional()
+  @IsIn(['admin', 'member'])
+  role?: 'admin' | 'member'
+}