feat: per-tenant server access kill switch

Add Tenant.serverAccessBlocked, toggle API with appVersion bump and settings push, and expose stealth server_reachable in get_user.

Co-authored-by: Cursor <cursoragent@cursor.com>

prisma/migrations/20260811120000_server_access_blocked/migration.sql

@@ -0,0 +1,7 @@
+-- Per-tenant app/admin access kill switch (shared physical servers stay up)
+
+ALTER TABLE "tenants"
+  ADD COLUMN IF NOT EXISTS "server_access_blocked" BOOLEAN NOT NULL DEFAULT false;
+
+ALTER TABLE "tenants"
+  ADD COLUMN IF NOT EXISTS "server_access_blocked_at" TIMESTAMP(3);

prisma/schema.prisma

@@ -76,6 +76,9 @@ model Tenant {
   /// Client cache-bust / force-reload signal for this sold version (GET /get_version).
   appVersion       String      @default("1") @map("app_version")
   isActive         Boolean     @default(true) @map("is_active")
+  /// Kill switch: block this sold version's app+admin (server stays up). Not the same as ServerAccount billing.
+  serverAccessBlocked   Boolean   @default(false) @map("server_access_blocked")
+  serverAccessBlockedAt DateTime? @map("server_access_blocked_at")
   notes            String?
   createdAt        DateTime    @default(now()) @map("created_at")
   updatedAt        DateTime    @updatedAt @map("updated_at")