Add initial tenant registration/defaulting to local auth setup

[kreneskyp]

Problem

During Filament local setup, repository/object data was seeded into the filament-sync tenant (00000000-0000-0000-0000-000000000000), but the bootstrap admin account only had the default tenant as its active default. As a result, signing into filament-ui as admin made /repos appear broken/empty even though the data and UI routes were working for the agent user whose default tenant had been switched to filament-sync.

The immediate repair was:

ix local auth tenant add admin@dev.ix \
  --tenant 00000000-0000-0000-0000-000000000000 \
  --role admin \
  --is-default

After re-login, admin sessions can see repos because the session token points at the tenant that contains the seeded data.

Request

ix-cli should provide a first-class way to register/select the initial tenant during local auth/bootstrap setup, instead of requiring post-hoc tenant repair.

Possible shapes:

• ix local init --tenant <tenant-id-or-name> registers the initial tenant and assigns bootstrap admin membership/default.
• ix local auth reset-admin preserves or accepts an explicit default tenant for the admin account.
• A dedicated command such as ix local auth tenant init --tenant <id> --name <name> --admin <email> creates/registers the initial tenant and pins admin default membership.

Acceptance Criteria

• Fresh local setup can declare the initial tenant used by Filament sync/seed data.
• Bootstrap admin is automatically a member of that tenant.
• Bootstrap admin defaults to that tenant when appropriate, so UI sessions query the data-bearing tenant immediately after login.
• The flow must not require resetting admin credentials.
• The flow should be idempotent and safe to rerun in local dev.

Context

This surfaced while debugging filament-ui.dev.ix/repos: the UI was functioning, but admin was scoped to the wrong tenant. The agent user had filament-sync as default and could see repos; admin had only default and saw empty data.

[kreneskyp]

Refinement: filament-sync should not be treated as the user/admin default tenant.

The missing bootstrap concept is probably an initial organization tenant, not simply "make the sync tenant default". Desired behavior:

• Local setup should let the operator provide an initial org/tenant name.
• If omitted, use a sensible default such as default.
• Filament sync/import should target that initial org tenant, or there should be an explicit mapping from the initial org to the sync/import tenant.
• Bootstrap admin should be able to administer the initial org tenant, but may also need membership in a separate admin/control tenant depending on the tenancy model.
• Avoid coupling the admin user's default tenant to an internal filament-sync tenant just to make seeded data visible.

The previous workaround made filament-sync admin's default only to unblock local debugging; it should not be the intended product/bootstrap behavior.

[kreneskyp]

Additional correction: avoid naming/modeling this as a special filament-sync tenant.

The sync process writes to a tenant. That tenant should be the configured initial org tenant (or whichever tenant the operator explicitly selects), not an implied product/internal tenant named filament-sync.

So the ix-cli/bootstrap contract should probably be:

• Create/register/select the initial org tenant.
• Ensure bootstrap admin has the right membership/role for that tenant.
• Ensure local sync/import targets that tenant consistently.
• Keep any admin/control-plane tenant separate if the model requires one.

The important bug is not "admin was missing filament-sync"; it is "bootstrap and sync did not agree on the initial tenant/org context."