v0.15.3

Registration no longer accepts companyId/role; tenant and role selection happens only through an authenticated invite.
Legacy JWT sessions are revalidated against an existing, active, non-deleted user; identity headers are derived from the credential, not from claims.
Company offboarding revokes tenant tokens, suspends the tenant in the Engine and then deactivates local data in one transaction.
OpenBao Agents now deliver the SaaS secrets; unit files and tracked examples no longer carry credentials.

audit_logs test teardown disables the chain trigger as well as the row guard, so the append-only contract stays meaningful in tests.
Two orphan i18n keys were removed.
Test database provisioning grants the app role the schema privileges it has in production.

Full unit suite green on the isolated CI database as the ci role: 896 pass, 0 fail. Typecheck and lint are green (lint: 0 errors).