feat(operator): partner management with attach/detach (O.6)

- Partners list with name/domain/status/customers/margin + Create modal
- Partner detail: contract card, contact card, customers table, attach modal,
  terminate (soft-delete) danger card
- Operator proxies for /partners + /partners/:slug/tenants
- platform-api: add partnerId Prop to Tenant schema. The field was being
  silently dropped by Mongoose because the schema didn't declare it.
- tenants.service: rewrite update() to build $set/$unset explicitly and cast
  partnerId via new Types.ObjectId(). Handles detach via $unset so the field
  vanishes from the doc cleanly.

services/platform-api/src/schemas/tenant.schema.ts

@@ -29,6 +29,10 @@ export class Tenant {
   @Prop({ type: [String], default: [] })
   domains!: string[]
 
+  // Optional MSP/reseller this tenant belongs to. Sparse — direct tenants have none.
+  @Prop({ type: Types.ObjectId, ref: 'Partner', index: true, sparse: true })
+  partnerId?: Types.ObjectId
+
   // External system handles — filled in by the provisioning worker (Phase 4)
   @Prop({ index: true, sparse: true })
   authentikGroupId?: string