Minimal UI for tenants, domains, and users.
Base + key stored in browser localStorage. Dry run adds ?dry_run=true to write calls.