[DEF-004] TenantsEndpoints — PUT (update) and DELETE (deactivate) tenant operations not mapped

## Summary

`TenantsEndpoints.cs` only maps `MapGet` and `MapPost`. There are no `MapPut` or `MapDelete` handlers, making it impossible to update or deactivate a tenant via the REST API.

## Location

- `src/Ato.Copilot.Mcp/Endpoints/TenantsEndpoints.cs`
- Only `MapGet` + `MapPost` present; `MapPut` and `MapDelete` are absent

## Severity

**MEDIUM** — Tenant lifecycle management (update, deactivate) is fully blocked. CRUD is incomplete for this entity.

## Steps to Reproduce

\`\`\`bash
curl -X PUT https:///api/dashboard/tenants/{tenantId} \
-H "Authorization: Bearer ..." -d '{...}'
# Expected: 200 or 204
# Actual: 404 Not Found (no route registered)

curl -X DELETE https:///api/dashboard/tenants/{tenantId} \
-H "Authorization: Bearer ..."
# Expected: 200 or 204
# Actual: 404 Not Found
\`\`\`

## Fix Direction

Add `MapPut` and `MapDelete` handlers in `TenantsEndpoints.cs` wired to the corresponding service methods (which likely already exist in the service layer).

## Evidence Source

- War Machine CRUD inventory `73e2e825caab4903` — Tenants update/delete marked 🔴
- War Machine CRUD inventory `7585c7dd31bf4758`
- Banner consolidated findings `539e6ef45fe842b8`

Start in src/Ato.Copilot.Mcp/Endpoints/TenantsEndpoints.cs and compare the existing MapGet and MapPost handlers with the tenant service layer to locate the corresponding update and deactivate methods. Add the missing PUT and DELETE route mappings, then verify that requests to /api/dashboard/tenants/{tenantId} no longer return 404 and produce the expected 200 or 204 response.

Written by the indexing model from the issue text.