Self-Serve Create Tenant

Creates a tenant (workspace) owned by the caller's person, who becomes its tenant_admin; returns tokens scoped to the new tenant. 403 self_serve_disabled when self-serve creation is off on this instance. 403 workspace_limit_reached when workspace-plan enforcement is on and the caller already owns as many live workspaces as their plan allows (the message states the allowed and owned counts; getSelfServeTenantAllowance returns both). Only workspaces the caller created through this endpoint count — being tenant_admin of someone else's tenant uses no slot. 403 verified_email_required when the caller signed up with only a passkey and has not verified an email yet.