Compact role editing and restore tenant-scoped Team, Customers and SLA administration

[Proxicon]

Summary

Closes #56.

This draft implements the compact role-editing/Team portion of the issue and the role-catalog upgrade path. It deliberately does not claim completion of tenant-scoped Customers or the four tenant SLA panels; those routes remain instance-admin-only in this draft.

Included

• Replaced permanent per-member checkbox lists with compact role summaries and TenantRoleAssignmentDialog, used by Organizations, scoped Team, and the eligible linked-customer access surface.
• Added member search, truthful empty state, fixed tenant/target capture in dialog save URLs, independent drafts, search that preserves selection, Cancel/Escape, unchanged-save disabling, and retained-save errors.
• Renders the scoped Team workflow at /admin/users for Tenant.Users.Manage / Tenant.Roles.Assign; instance administrators retain the global Team workflow. The tenant navigation links Team without duplicating the instance administration tree.
• Reworked the Roles & Permissions protected marker into a small, outlined, neutral, content-width lock status chip with component-scoped row spacing and role search.
• Added Tenant.Customers.Manage and Tenant.Sla.Manage to the protected Tenant Administrator catalog and idempotent seed reconciliation, while keeping both outside the delegation ceiling. The tenant lookup endpoint now has an explicit permission allowlist and supports the new permissions.

Authorization matrix

Operation	Authority
View scoped Team members	Tenant.Users.Manage or Tenant.Roles.Assign in the selected tenant
Edit application role assignments	Tenant.Roles.Assign in the selected tenant
Invite local tenant account	both Tenant.Users.Manage and Tenant.Roles.Assign in the same tenant
Global Team/account lifecycle	HelpdeskAdmin only
Tenant Customers / SLA routes	Not implemented in this draft; still HelpdeskAdmin only

Upgrade impact

The existing RoleDefinitionSeeder reconciles persisted protected Tenant Administrator definitions on startup and role-definition reads. Existing assignments inherit the two new capabilities; custom roles and the tenant delegation ceiling are unchanged. No database migration is required.

Validation

• dotnet build Helpdesk.sln --configuration Release --no-restore — passed (existing project warnings only).
• Focused CurrentUserAccessServiceTests and PageAuthorizationConventionsTests — passed, 17/17.
• Dirty-file Slopwatch hook — passed. Repository-wide Slopwatch remains blocked by pre-existing findings and no committed baseline.
• Local-auth integration selection and full suite/UX/browser/screenshots/PostgreSQL validation — not completed in this draft.

Base SHA: 1f80f1b5970b8cbf18c0e1b5d286f60a2b734e8e.

Implementation commit: 77b0e2a.

No private/customer screenshots or data are included.