feat(operator): visual-only screens with real-data overview (O.7)

- Overview (pages/index.vue): KPIs from real /tenants /partners /users,
  status meter, recent + needs-follow-up tables. Mock activity stream and
  incident banner overlay come from data/fixtures.ts.
- Operator team: real GET /users filtered to platformAdmin === true,
  with last-seen + tenant counts.
- Users (global): real read with All/Admins/Inactive views and search.
- Infrastructure / Feature flags / Audit: mock fixtures only — wiring to
  real backends (Prometheus, OpenFeature, append-only audit) is tracked
  as follow-ups in OPERATOR-PLAN.md.
- Placeholder pages (support/billing/reports/settings) via OpPlaceholder.
- Shared: Stat, MetricCell, OpPlaceholder components, /api/users proxy,
  PlatformUser type.
- .gitignore: scope the docker volumes data/ rule so apps/*/data/ is
  tracked again (operator carries mock fixtures there).

docs/OPERATOR-PLAN.md

@@ -430,22 +430,29 @@ forward as bearer to platform-api.
 - MRR aggregation deferred until Subscription gains real pricing (see
   follow-ups). For now `customers` is just a count of attached tenants.
 
-### O.7 · Visual-only screens (mock fixtures)
+### O.7 · Visual-only screens (mock fixtures) ✓
 
-- [ ] `data/*.ts` — typed mock fixtures (tenants-extra, partners-extra,
-      services, incident, flags, audit, team)
-- [ ] `pages/index.vue` — Overview dashboard
-- [ ] `pages/operator-team.vue` — real backend (Users where
-      `platformAdmin === true`)
-- [ ] `pages/users.vue` — global users, real read
-- [ ] `pages/infrastructure.vue` — service health (mock for now;
-      docker health check integration is a follow-up)
-- [ ] `pages/flags.vue` — feature flags (mock)
-- [ ] `pages/audit.vue` — global audit (mock)
-- [ ] `pages/support.vue` — placeholder
-- [ ] `pages/billing.vue` — placeholder
-- [ ] `pages/reports.vue` — placeholder
-- [ ] `pages/settings.vue` — placeholder
+- [x] `data/fixtures.ts` — typed mock fixtures (SERVICES, INCIDENT, FLAGS,
+      OP_AUDIT). Tenant/partner/user extras are NOT mocked — those screens
+      pull from the real backend.
+- [x] `pages/index.vue` — Overview dashboard: KPIs from real tenants/partners
+      /users + status meter + recent + needs-follow-up tables, with mock
+      activity stream + incident banner overlay.
+- [x] `pages/operator-team.vue` — real `GET /users` filtered to
+      `platformAdmin === true`.
+- [x] `pages/users.vue` — real `GET /users` with All / Admins / Inactive
+      views and search.
+- [x] `pages/infrastructure.vue` — service health (mock SERVICES);
+      docker healthcheck + Prometheus wiring is a follow-up.
+- [x] `pages/flags.vue` — feature flags (mock FLAGS).
+- [x] `pages/audit.vue` — cross-tenant audit (mock OP_AUDIT) with search.
+- [x] `pages/support.vue` — `OpPlaceholder` stub.
+- [x] `pages/billing.vue` — `OpPlaceholder` stub.
+- [x] `pages/reports.vue` — `OpPlaceholder` stub.
+- [x] `pages/settings.vue` — `OpPlaceholder` stub.
+- [x] Shared bits added: `components/Stat.vue`, `components/MetricCell.vue`,
+      `components/OpPlaceholder.vue`, `server/api/users/index.get.ts`,
+      `types/user.ts`.
 
 ### O.8 · Interactions