feat(02-01): UserModule, TenantModule, admin seed, and app.module wiring

- Create UserService with findByUsername (unscoped), create, update, deactivate, delete
- Create AdminSeedService that seeds Super-Admin from Docker ENV on bootstrap (D-05/D-07/D-13)
- Create TenantService with findAll, findById, create, update
- Create TenantMiddleware extracting tenantId from JWT with Super-Admin tenant switching (D-08/D-10)
- Wire PrismaModule, AuthModule, UserModule, TenantModule into AppModule
- Register JwtAuthGuard and RolesGuard as global APP_GUARD providers
- Apply TenantMiddleware to all routes via NestModule.configure
- Add @Public() decorator to HealthController for unauthenticated access

apps/api/src/tenant/tenant.service.ts

@@ -0,0 +1,23 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from '../prisma/prisma.service';
+
+@Injectable()
+export class TenantService {
+  constructor(private prisma: PrismaService) {}
+
+  async findAll() {
+    return this.prisma.tenant.findMany();
+  }
+
+  async findById(id: string) {
+    return this.prisma.tenant.findUnique({ where: { id } });
+  }
+
+  async create(data: { name: string; slug: string }) {
+    return this.prisma.tenant.create({ data });
+  }
+
+  async update(id: string, data: { name?: string; slug?: string; isActive?: boolean }) {
+    return this.prisma.tenant.update({ where: { id }, data });
+  }
+}