Founder-only control plane for tenants, pilots, abuse response, and operational overrides.

This route is hidden behind admin access and now includes real write controls for company state, pilot workflow, refund tracking, and kill-switch execution.