Stack layer 2, depends on PAR-481. Provide tenant-scoped support details: membership identity/role lookup, invitation state, API-key metadata (never secrets), integration/queue health, and staff access history. Operators can record a support note, rename a workspace, revoke a workspace API key and revoke an invitation. Require a nonblank support reason, verified unrestricted staff, transactional durable audit, tenant-scoped targets and validation. Preserve owner-only powers; no arbitrary impersonation, owner grants, permanent deletion or external-service actions. Add cross-tenant, authorization and audit tests.
Implemented in stack layer 2: https://github.com/ParadauxIO/taskl.ie/pull/99, based on layer 1 (#94). All 1,315 backend tests pass. Real PostgreSQL tests prove audit-failure rollback, tenant-safe key/invite revocation and preserved workspace URLs; unsigned staff headers and non-staff access are rejected. Browser journey also verified support notes, rename, both revocations and persisted audit reasons.
Implementation plan: three dependent PRs, API directory/statistics → support diagnostics/actions → console. Verify with staff/ordinary-user/key rejection tests, real Postgres tenant isolation and atomic auditing, generated OpenAPI, frontend lint/types/unit/story checks and browser evidence. Remote main includes the merged rebuild; root PR will target main, following PRs their preceding stack branch.