<!--
PR title MUST be a Conventional Commit, e.g.:
  feat(api): add POST /v1/tenants/:id/cancel
  fix(auth): reject JWT when org_id missing

Mark draft if not ready for review.
-->

## What

<!-- 1–3 bullets. What does this PR change? -->
-

## Why

<!-- Link the architecture section, milestone ID, or issue this addresses. -->

Linked milestone: **M13.1**

<!-- Optional: closes #123, refs #456 -->

## How

<!-- Notes for the reviewer: the interesting design choices, the tricky bits, what NOT to focus on. Skip if obvious from the diff. -->

## Test plan

- [ ] Unit tests added/updated
- [ ] Integration tests added/updated (real DB via testcontainers)
- [ ] Playwright e2e added/updated (only if user-facing flow changed)
- [ ] Manual smoke on stage after deploy
- [ ] Regression test added (only if this PR fixes a bug — must fail before the fix)

<!-- If a row is genuinely n/a, leave it unchecked and explain below. -->

## Risk

**Blast radius:** <!-- single tenant / all tenants / single product / portal-wide / data-plane / infra -->

**What could break:**
-

**Rollback plan:**
<!-- e.g. `orca rollout undo {service} --env=prod`, or "revert the PR and redeploy" -->

## Checklist

- [ ] Docs updated (or n/a — explain)
- [ ] Audit events emitted for state changes (or n/a)
- [ ] Secrets via Infisical, never in repo
- [ ] Migration is forward-only + idempotent (or no migration)
- [ ] Tenant scoping enforced on every DB query (or no DB access)
- [ ] OpenAPI spec updated (or no API change)
- [ ] `featureFlags.evaluate()` used for any toggleable behavior (or n/a)
- [ ] CHANGELOG entry under "Unreleased" (or n/a)

## Screenshots / recordings

<!-- For UI changes. Drop a screenshot or a Loom link. -->

---

<!--
Reviewer reminder: in this order — risk → tests → security → correctness → style.
Squash-merge after approval. PR title becomes the commit message.
-->