WARDEN-WP-0028 added mount tenants/ for client secrets; platform-admin only covered platform/* and secret/*, so UI operators could not see binky paths. Add tenants/* CRUD+list.