Platform admin

Reserved for tenants, domains, theme tokens, encrypted PITs and sync status. Not built yet — one tenant does not need it.