Accounts: an account above tenants for agencies and resellers, with console branding as data

There is nothing above a tenant. Managing tenants needs `ManageTenants` or SuperAdmin on the whole deployment (`barakoCMS/Features/Tenants/Endpoints.cs:44`, `:137`, `:215`), and cross-tenant audit is SuperAdmin only. Console branding is a freeform dictionary on the tenant (`barakoCMS/Models/Tenant.cs:35`), #885 moves the club profile off Tenant, and barakoBrew hardcodes its wordmark.

### Why it matters

An agency running ten client sites wants its staff to see and manage its own ten tenants and nobody else's, and to put its own name on the console. A reseller hosting several agencies needs the same one level up. Today the only way to manage more than one tenant is to be an operator of the whole box.

### The general concept

An account that owns tenants, with its own members and roles, so a capability like `ManageTenants` can be granted within an account. Console branding (name, logo, colours) is account data the console reads, not a build setting.

### Where it lives

Core: tenants and roles. Console reads the branding (barakoBrew #15).

### Compatibility

Released. Existing deployments get one implicit account holding every tenant, so today's operators keep the access they have. `Tenant.Branding` keeps being read as a fallback until the account's branding is set.

### Done when

- A user with `ManageTenants` in one account lists and edits only that account's tenants, and a test showing that fails today.
- The console shows the account's name and logo from the API.
- A deployment with no accounts configured behaves as today.

Found in the architecture sweep of 15 September 2026.

Read barakoCMS/Features/Tenants/Endpoints.cs at lines 44, 137, and 215, then inspect barakoCMS/Models/Tenant.cs at line 35 and barakoBrew issue #15. Trace how tenant permissions and branding are currently handled before defining the account boundary. Done means account-scoped tenant management, API-backed console name and logo, compatibility for deployments without accounts, and tests for the stated access behavior.

Written by the indexing model from the issue text.