Tenants: export, import, move, archive and erase a tenant as one unit

A tenant cannot be moved, archived or erased as a unit. Portability carries content types and content only (`BarakoCMS.Portability/PortabilityModels.cs:6-12`). `barakoCMS/Features/Tenants/Endpoints.cs` has list, create and update (`:43`, `:136`, `:214`) and no delete. Memberships, API keys (`ApiKey.TenantSlug`) and the audit chain are single tenanted rows keyed by slug (`barakoCMS/Extensions/ServiceCollectionExtensions.cs:693`, `:707`), and redirects, workflows, connectors and stored files sit outside any bundle. Backups dump the whole database (`scripts/backup-cron.sh:44-46`).

### Why it matters

An agency moving one client to their own server, a client leaving and asking for their data, or a school asking for erasure all need the same thing: everything that carries this tenant, and nothing that does not. Today it is hand-written SQL per table, and restoring one client from a whole-database dump overwrites everyone else.

### The general concept

A queued job that walks every document carrying the tenant id plus the global rows keyed by its slug, and exports, imports, archives or erases them as one bundle. Modules add their documents through a hook (Files adds its bytes). Connector secrets are re-wrapped under a transfer key so the bundle never holds them in clear and the target can open them with its own key.

Part of the decision on the tenant as the unit of operation, linked from the umbrella issue.

### Where it lives

Core: tenants and jobs, with a hook implemented by modules (Files, Portability's successor).

### Compatibility

Released surfaces are only added to: new endpoints and a job. No stored data changes shape. Portability's existing export and import keep working until the config export engine replaces them.

### Done when

- A tenant exported from one instance and imported into an empty one serves the same content, files, members, redirects and workflows, and a test showing that fails today.
- Erasing a tenant leaves no row carrying its id or slug, and another tenant is untouched.
- A connector secret in the bundle is not readable without the transfer key.

Found in the architecture sweep of 15 September 2026.

Start by reading barakoCMS/Features/Tenants/Endpoints.cs, BarakoCMS.Portability/PortabilityModels.cs, and the tenant-keyed registrations in barakoCMS/Extensions/ServiceCollectionExtensions.cs. Inspect scripts/backup-cron.sh and existing portability behavior before mapping the queued job and module hooks. Done means the specified export, import, archive, and erase behavior is covered by tests, including isolation and protection of connector secrets.

Written by the indexing model from the issue text.