[P1] ADR: self-serve identity architecture and tenant model

[simonholmes001]

Parent epic: #451

Objective

Choose and approve the identity architecture for self-serve onboarding.

Scope

• Evaluate Entra External ID/B2C or equivalent approach for public signup
• Define tenant model, token issuer/audience strategy, and trust boundaries
• Define migration path from current invite-only Entra tenant setup
• Record decision and rejected alternatives

Acceptance criteria

• ADR approved with clear implementation target
• Token validation model for backend is documented
• Public onboarding risks and mitigations are explicit