Provision New User

Bootstrap tenancy for a freshly-created auth.user.

The body is the same bytes the front signed — we re-parse them with Pydantic here rather than declaring body: ProvisionNewUserRequest on the signature because FastAPI would otherwise read the request stream before the HMAC dep gets a chance, leaving the dep with an empty body to hash.