Task: The IAM audited entities: tenant and role

Implement tenant and role as full entities: field-group tabs, a searchable foreign-key select for tenant's type and status, history, and role's relationship to permissions. role's permissions tab is the first use of the Related machinery against a relationship the service serves by message.

• tenant and role each have list, detail and history screens.
• tenant's type and status are searchable selects, never free text.
• role's permissions are readable and the mechanism for changing them is stated.
• Both prompt for an audit reason on every create, amend and delete.

(Implementation strategy. Written when work starts; key decisions are distilled into the parent story's * Decisions at close, but the plan itself stays — it is the historical record of what we did.)

Manual QA scenarios (scaffolded via compass add test_scenario) that verify this task. Link new ones here as they're created; the scenario doc itself links back via its "Verifies task" field.

Superseded on 2026-09-23. tenant and role were to be built as declarations on the shell, and the shell is deleted. The journey screens replace them and keep the generated protocol and domain types they were to read.