PR #780: fix(auth): enforce tenant-bound identity lifecycle

Release Notes

Summary

Organization administrators can now manage users and identities only within their own organization. Removing a user, suspending access, or deleting an account affects organization membership and tenant sessions without deleting shared login identities that may belong to other organizations.

Changes

• User removal and account deletion now remove the user from the current organization instead of deleting their global login identity.
• Suspending or deactivating a user identity now revokes that user's active sessions for the tenant.
• New user and partner invitations are sent through organization-bound invitation flows. If an invitation cannot be delivered, the pending user record is rolled back.
• Accepted invitations are reconciled more reliably, including for external partner users.
• Sign-in now validates that the authenticated organization matches the tenant session. Mismatches are rejected and recorded in audit logs.
• User identity suspend, activate, and remove actions in the admin UI now route through the correct organization or partner authorization path.
• Generic identity update and delete actions are limited to agent identities; user identities must be managed through the dedicated user management flows.

Impact

Security/audit impact: Tenant administrators can no longer affect login identities or memberships outside their organization. Audit logs now record organization membership changes separately from global identity deletion.

Classification

Auth, Security, Admin, Tenant Workflow, Audit / Logging, API, UI, Bug Fix