feat: per-tenant server access kill switch

Add Tenant.serverAccessBlocked, toggle API with appVersion bump and settings push, and expose stealth server_reachable in get_user.

Co-authored-by: Cursor <cursoragent@cursor.com>

prisma/schema.prisma

@@ -76,6 +76,9 @@ model Tenant {
   /// Client cache-bust / force-reload signal for this sold version (GET /get_version).
   appVersion       String      @default("1") @map("app_version")
   isActive         Boolean     @default(true) @map("is_active")
+  /// Kill switch: block this sold version's app+admin (server stays up). Not the same as ServerAccount billing.
+  serverAccessBlocked   Boolean   @default(false) @map("server_access_blocked")
+  serverAccessBlockedAt DateTime? @map("server_access_blocked_at")
   notes            String?
   createdAt        DateTime    @default(now()) @map("created_at")
   updatedAt        DateTime    @updatedAt @map("updated_at")