Report tenant grouping from the authority record

tenant-engine has made grouping mutable through its own reclassification
route, so a tenant created as tenant:small:acme can report grouping "large".
The identifier's grouping segment is now historical and must not be parsed.

TenantRecord dropped the field entirely, so the portal read discarded the one
safe source of a tenant's classification and left an operator with nothing but
the identifier to infer from — exactly the mistake the change creates. The
record and adapter now carry grouping, the operator screen shows it with a
note that the identifier segment is not the grouping, and the OpenAPI schema
documents where to read it.

Also corrects the UpdateTenant description, which still claimed grouping was
immutable. It is mutable, but never as metadata, because it resolves a
tenant's spend ceiling.

No reclassification control is offered here: that route is not deployed yet
and, per tenant-engine, wants its own permission rather than riding on rename.

Full suite: 149 tests, 3 provider-gated skips.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

openapi/portal-v1.yaml

@@ -379,8 +379,10 @@ components:
         metadata:
           type: object
           description: >-
-            Mutable tenant metadata. tenant_id, identifier, and grouping are
-            immutable at the authority and are rejected here.
+            Mutable tenant metadata. tenant_id and identifier are immutable at
+            the authority and are rejected here. grouping is mutable but only
+            through the authority's own reclassification route, never as
+            metadata, because it resolves a tenant's spend ceiling.
           minProperties: 1
           properties:
             display_name: {type: string, minLength: 1, maxLength: 200}
@@ -396,6 +398,13 @@ components:
         external_ref: {type: string}
         lifecycle: {type: string, enum: [active, retired, unknown]}
         version: {type: integer, minimum: 0}
+        grouping:
+          type: string
+          nullable: true
+          description: >-
+            Authoritative classification, reported by the tenant authority.
+            Read it from here; never parse it from the identifier, whose own
+            grouping segment is historical once a tenant is reclassified.
         display_name: {type: string, nullable: true}
         contact_email: {type: string, nullable: true}
         retired_at: {type: string, nullable: true}