feat(saas): Phase 3 — plan/seats/active model, ToS consent, signed expiring export

P3a: org carries plan/seats/active/created_at; create_user enforces seats + rejects
inactive org; verify blocks login for inactive orgs; PATCH /api/admin/orgs (super_admin)
updates plan/seats/active with audit. Fixed verify swallowing its AuthError.
P3b: export/token issues a 5-min HMAC one-time CSV link; export accepts ?token=.
P3c: setup requires accepted_terms (consent stored); Setup.vue consent checkbox.
All 8 backend suites pass. Rebuilt dist.

backend/app/api/admin_routes.py

@@ -53,6 +53,37 @@ def list_orgs():
     return jsonify({"orgs": [org] if org else []})
 
 
+@admin_bp.patch("/orgs/<org_id>")
+@require_auth
+@require_roles("super_admin")
+def update_org(org_id: str):
+    """Platform: set org plan / seats / active. super_admin only."""
+    data = request.get_json(silent=True) or {}
+    org = _store().orgs.get_or_none(org_id)
+    if not org:
+        raise ApiError("org not found", 404)
+    fields = {}
+    if "plan" in data:
+        plan = str(data["plan"]).strip()
+        if plan not in ("trial", "paid", "enterprise"):
+            raise ApiError("invalid plan (trial/paid/enterprise)")
+        fields["plan"] = plan
+    if "seats" in data:
+        try:
+            seats = int(data["seats"])
+        except (TypeError, ValueError):
+            raise ApiError("invalid seats")
+        if seats < 1:
+            raise ApiError("seats must be >= 1")
+        fields["seats"] = seats
+    if "active" in data:
+        fields["active"] = bool(data["active"])
+    if fields:
+        _store().orgs.update(org_id, **fields)
+    _log_audit("org.update", org_id, detail=fields)
+    return jsonify({"org": _store().orgs.get(org_id)})
+
+
 @admin_bp.post("/users")
 @require_auth
 @require_roles("admin")