feat: per-tenant server access kill switch

Add Tenant.serverAccessBlocked, toggle API with appVersion bump and settings push, and expose stealth server_reachable in get_user.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/get-user/get-user.service.ts

@@ -79,6 +79,8 @@ export class GetUserService {
       product: tenant.product,
       theme: themeMode,
       mode: themeMode,
+      /** Stealth cold-boot gate — false looks like product server unreachable */
+      server_reachable: !Boolean(tenant.serverAccessBlocked),
       /** Khanegi front-end family for consumers */
       ui_variant: isKhanegi ? uiVariant : undefined,
       app_ui_config: