Task: Remaining NATS changes

Round of follow-up fixes after the NATS landing — tenant provisioning, RBAC, LEI handler, audit attribution, wt service startup.

• Tenant provisioning auto-creates system party + seeds bootstrap-mode flag (triggers provisioning wizard on first login).
• Server-side UUID generation in tenant_handler::save() when client omits it.
• account_handler fixed to use make_request_context for tenant scoping.
• lei_entity_handler::summary() calls new SQL functions ores_dq_lei_entities_distinct_countries_fn() + ores_dq_lei_entities_summary_by_country_fn() instead of inline SQL (DISTINCT ON (lei) dedup for GLEIF counterparty picker).
• PQsetNoticeProcessor installed in pg_connection_guard so PL/pgSQL NOTICEs route through Boost.Log rather than stdout.
• Provisioning wizard parity restored after NATS migration (depth controls, contact counts, reproducibility seed).
• performed_by audit field correctly reflects the service account for service-initiated actions; modified_by continues to capture end-user.
• ores.wt.service startup crash fixed (excluded from NATS service discovery to prevent env collisions; Wt-specific arguments correctly passed).

Captured during execution; cleared into the parent story on close.

Follow-up sweep covering the things the big NATS PR couldn't catch in one pass.

NATS migration sweep closed cleanly.