[naobadiah01]

Summary

Closes #399

Implements multi-tenant institution workspaces with strict data isolation:

• Workspace provisioning — institutions provision isolated workspaces via POST /api/tenants (backed by a new Organization model).
• Role hierarchy — owner > admin > instructor > registrar, enforced in the service and middleware (role assignment guards against privilege escalation).
• Credential issuance scoping — credentials can only be issued within the institution's configured authority (allowed types, enabled flag, per-member cap).
• Member invitation flow — owner/admin invite members; invitations are accepted to create active memberships.
• Cross-tenant isolation — every read is keyed by workspace id; unit tests verify members and credentials never leak across workspaces.
• Frontend workspace UI — /institution page for provisioning workspaces and inviting members.

Changes

Backend

• backend/src/models/Organization.ts — new model
• backend/src/services/tenants/ — tenancy service and role hierarchy
• backend/src/middleware/tenant.ts — isolation middleware
• backend/src/routes/tenants.ts — REST routes + OpenAPI docs, mounted at /api/tenants and /api/v1/tenants
• Removed dead tenancy scaffolding that referenced a non-existent controller
• Tests: backend/tests/services/tenantService.test.ts, backend/tests/middleware/tenant.test.ts

Frontend

• frontend/src/app/institution/ — workspace provisioning and member invitation UI
• Fixed a TourProvider SSR regression that was failing the static build for every page

Testing

• Backend: npm test -w backend (new suites: 31 tests passing)
• Backend typecheck/build: npm run build -w backend
• Frontend: npm run build -w frontend
• OpenAPI spec validates successfully with all new tenant paths documented