When remoteApiToken is empty, sign SuperAdmin→product /super/settings
with the same SMS_REMOTE_SHARED_SECRET + domain headers used by SMS.
Co-authored-by: Cursor <cursoragent@cursor.com>
Add Tenant.serverAccessBlocked, toggle API with appVersion bump and settings push, and expose stealth server_reachable in get_user.
Co-authored-by: Cursor <cursoragent@cursor.com>