feat(01-05): super-admin API routes and middleware guard

- withSuperAdmin() HOF: checks isSuperAdmin from session, returns 401/403
- GET /api/admin/tenants: lists all tenants with userCount, subscriberCount
- GET /api/admin/tenants/[id]: single tenant detail with users list
- POST /api/admin/tenants/[id]/suspend: suspend/activate with 7-day grace
- prisma/seed.ts: add Test ISP 2 tenant and admin2@demo.com for isolation tests

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

prisma/seed.ts

@@ -82,8 +82,51 @@ async function main() {
 
   console.log(`Super-admin upserted: ${superAdmin.email} (${superAdmin.id})`);
 
+  // -----------------------------------------------------------------------
+  // Tenant: Test ISP 2 (for cross-tenant isolation testing)
+  // -----------------------------------------------------------------------
+  const demoTenant2 = await prisma.tenant.upsert({
+    where: { slug: "test-isp-2" },
+    update: {},
+    create: {
+      name: "Test ISP 2",
+      slug: "test-isp-2",
+      ownerEmail: "admin2@demo.com",
+      status: TenantStatus.ACTIVE,
+    },
+  });
+
+  console.log(`Tenant upserted: ${demoTenant2.name} (${demoTenant2.id})`);
+
+  // -----------------------------------------------------------------------
+  // Admin user: admin2@demo.com / admin123
+  // Scoped to Test ISP 2 tenant (for cross-tenant isolation tests)
+  // -----------------------------------------------------------------------
+  const admin2User = await prisma.user.upsert({
+    where: {
+      email_tenantId: {
+        email: "admin2@demo.com",
+        tenantId: demoTenant2.id,
+      },
+    },
+    update: {},
+    create: {
+      email: "admin2@demo.com",
+      passwordHash: adminPasswordHash,
+      firstName: "Demo",
+      lastName: "Admin2",
+      tenantId: demoTenant2.id,
+      roles: ["ADMIN"],
+      isActive: true,
+      isSuperAdmin: false,
+    },
+  });
+
+  console.log(`Admin2 user upserted: ${admin2User.email} (${admin2User.id})`);
+
   console.log("\nSeed complete. Test credentials:");
   console.log("  Admin:       admin@demo.com / admin123");
+  console.log("  Admin2:      admin2@demo.com / admin123");
   console.log("  Super-admin: superadmin@netforge.com / super123");
 }