List tenant secret metadata

Requires an owner/admin browser session with recent MFA. Returns metadata only; secret values are never included in responses. Tenant API keys and agent tokens cannot read this inventory.