feat: consolidate rc.8 administration and branding

[Proxicon]

Closes #52

rc.8 scope

• Consolidates delegated organization membership and settings under Administration while preserving scoped tenant APIs.
• Adds assignment detail inspection and makes local customer-login status use the persisted local-account link.
• Retains instance-branding overrides separately from effective defaults and validates safe bundled asset paths.
• Fixes tenant-editor route changes: a fixed organizationId is reapplied whenever parameters change, so A → unscoped selector → B → browser Back to A reloads A before member/settings requests or saves.
• Prevents Authentik invitations when the provider is unconfigured. The API advertises no usable Invite capability and rejects the request before any provisional external link is created.

Deferred from this rc.8 test release

• Delegated Customer Management and externally linked customer-role editing.
• Searchable member list and focused edit-dialog presentation.
• Remaining role-screen improvements and automatic opening of instance-admin organization deep links.
• Sanitized workflow screenshots.
• Inline local-invitation UI for fresh contacts.

Validation

• Focused regressions: 13 passed (CustomerAuthEndpointsTests, tenant route-state, and page conventions).
• CI is green for f4d3739: .NET validation, Playwright UX, PostgreSQL first-run/setup, compose startup, all container builds, and policy/layout checks passed.

No production environment, identities, images, deployment, merge, or release tag was changed. PR #53 remains draft pending the requested merge decision.