User management

SSO, OAuth, MFA, and role-based permissions per tenant.

Tenant isolation ensures users never cross tenant boundaries.