Admin actions are restricted to tenant admins

Unauthenticated request. Platform-admin behavior remains separate from tenant UI, and support admins do not get silent tenant access.