[R1-15a backend] List platform tenant metadata for operators

[smiggleworth]

Backend child of #237 under R1 — Readiness program scoped. Deliver an operator-only, paginated tenant metadata inventory through GET /api/v1/platform/tenants and a read-only list_platform_tenants MCP tool. Define snake_case route, query, JSON, result, error, and OpenAPI contracts first. Reuse IPlatformOperatorRequest and the explicitly configured PlatformOperatorAuthority; add a Portia query handler over the existing global Fitz TenantDirectory projection and event history. Return only tenant identity, names, slug, provisioning/lifecycle status, first-administrator invitation indicator, and operator attribution. Do not expose client business records or give the operator implicit tenant membership, role grants, or engagement assignment.

Prove operator allow and nonoperator deny without disclosing tenant identities or counts, stable pagination, status changes and replay, projection lag and recoverable failure, and standalone/split API-worker parity. Close only after backend acceptance evidence and exact-head CI are linked. Keep #237 and product parent #127 open for later UI/integration.

Applicable backend dependencies: #152 (R1-15 backend foundation), #157 (EN-01 backend), #123 (M0-D25 tenant/operator policy), #126 (M0-A07 tenant context), and #139 (M0-D28 canonical model). M0-D24 #136 is UI-only. Platform operator status grant/revoke and cross-tenant client business-data authority remain unresolved in #123 and are outside this child.

Later M0-D25 decision

This closed issue records the operator-directory capability as delivered with the then configured operator authority; it does not claim to deliver later operator grants. M0-D25, accepted 2026-09-22, now requires in-product operator grants and revocations, initial configuration bootstrap only, and metadata-only operator access. R1-15 backend #152 owns that remaining change. The historical delivery evidence above remains unchanged.

[smiggleworth]

Operator inventory remains pending after local prototype. The existing global TenantDirectory projection has no list index on historical rows. Fitz KvDirectory.BackfillAsync is a committed, resumable write migration; invoking it on every GET/page made reads O(all tenants) writes and produced a split-host 500 while competing with the projector. We will not ship that request-path workaround. The backend needs a worker-owned, durable cursor/completion marker, a query readiness gate, and multi-worker restart/concurrency proof before exposing the paginated HTTP/MCP portfolio. The configured platform Operator and its existing lifecycle authority remain available. Cross-tenant client business-record access and operator grant/revoke policy remain separate open decisions under #123/#60.