Manually onboard a new tenant — creates the tenant, its default security settings, and its first Admin user (api_response_shapes.md §13.5).