420ff1e715
- Tenant admin user list filters out SITE_ADMIN users (server-side) - API guard prevents tenant admins from modifying SITE_ADMIN users - Tenant admins cannot change their own role (prevents self-demotion) - Nav bar shows separate "Site Admin" link for SITE_ADMIN users - Both desktop and mobile nav updated Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>