Summary

One metric row per tenant the caller may read: accounts, active accounts, KYC-verified accounts, groups, pending invites and last signup — the platform-console view that replaces a list-then-N-counts loop. Scoped by the SAME compiled row filter as GET /tenants, so a tenant admin sees exactly their own tenant's row and a platform admin sees their own tenant's row by default — all_tenants=true for one row per tenant on the platform, tenant_id for one other tenant; a non-admin caller simply gets one row (their own), never an error. unowned on each row means the workspace has no owner and so counts against nobody's workspace plan, and the top-level unowned counts those across the whole visible set (ignoring paging, like total) — the operator's answer to "how many live workspaces is nobody being billed for"; a tenant_admin can fix their own with claimWorkspace.