auth+admin: tenant switcher — POST /auth/switch-tenant + active-tenant chrome (split from #71)

[rrrodzilla]

Split from #71. The reusable platform capability behind the issue-filer's "Organization" framing is tenant switching, generic over whatever schema is marked @tenant (there is no Organization platform schema — tenancy is polymorphic: TenantMembership.tenant_type + tenant_id).

Scope

Backend

• POST /api/v1/forge/auth/switch-tenant — set the caller's active tenant to one of their TenantMembership rows; re-mint the PASETO with the updated active_tenant / tenant_chain claims. Mirrors the /auth/me contract shipped in auth: expose /auth/me principal endpoint (user_id, tenant_chain, active_tenant) and /auth/switch-tenant #70.
• Reject switching to a tenant the caller has no membership in (defense-in-depth; not just UI gating).

Frontend (generated admin shell)

• Header chip showing the operator's active_tenant + tenant_chain (data plane already exists via GET /auth/me, auth: expose /auth/me principal endpoint (user_id, tenant_chain, active_tenant) and /auth/switch-tenant #70).
• "Operating as: platform_admin" badge when no tenant scope is in effect, so it's obvious why cross-tenant data is visible.
• Tenant picker sourced from the caller's memberships; switching calls the endpoint above and refreshes the session.

Out of scope / depends on

• Builds on auth: expose /auth/me principal endpoint (user_id, tenant_chain, active_tenant) and /auth/switch-tenant #70 (/auth/me).
• Invite & onboard is tracked separately under admin: polished tenancy UX (Org/User/TenantMembership/Role) — replace generic CRUD with invite + role-picker + membership composer #71.

Notes

• "Organization" is domain-specific naming; this surface must stay generic over the @tenant root schema so it works for every SchemaForge product.