Users
Tenant user and simplified role administration scaffold.
Admin workflows will be connected after Entra authentication and tenant membership validation.