Tenant Management

Tenant Management replaces the scattered Cosmos queries operators used to run by hand. The directory at `sys/(dashboard)/tenants` lists every tenant with type (federation/club/pilot/sandbox), plan, status, created date, and primary contact. Filters and sorts are server-driven, and an export emits CSV for finance and legal reviews.

Drilling into a tenant opens a single-page detail with the full operational picture: configuration, billing profile, feature flags, OrgNode hierarchy, user count, revenue summary, and a recent-activity feed sourced from `sys_audit_entries`. New tenants are provisioned through a guided wizard that captures slug, country, hierarchy depth (Norway flat, Sweden two-level, France three-level), initial admin email, plan, and trial length; on completion it dispatches `seed_system_roles` and triggers the onboarding email through the marketing pipeline. Feature flags mirror GrowthBook for tenant-controlled rollouts, but sys operators can override per tenant for targeted testing or incident mitigation; every override is audited.

The `Visit tenant` action is a one-click sys-scoped impersonation into the tenant's admin context — read-only by default, elevated only when the operator explicitly switches access level (which falls back to the F21.02 consent flow when the target is a real user rather than the tenant boundary). Archival is intentionally reversible: writes are disabled, reads stay live for 90 days, and a hard delete is then scheduled. The window can be unwound at any time inside the 90-day grace period.

Export produces a zip containing all tenant data — documents, uploaded assets, and the full audit log — packaged for GDPR exit or contract termination.