Grants the built-in TENANT_ADMINISTRATOR composite role to an existing,
activated user of the named tenant, from the platform plane.

What this operation does

1. Resolves the built-in TENANT_ADMINISTRATOR catalogue row — the global
   one (tenant_id IS NULL AND is_system AND deleted_at IS NULL), never a
   tenant-local role that merely shares the name.
2. Refuses if the TARGET tenant does not admit that role. The platform tenant
   (00000000-0000-0000-0000-000000000001) does not: a
   TENANT_ composite is a tenant-context role, and admitting it there
   would let a platform caller grant itself
   admin.keys.orchestrate, which no platform composite carries.
3. Refuses unless the deployment is customer-operated and the caller is on the
   platform plane.
4. Refuses unless the target user exists, lives in the named tenant, and both the
   user and the tenant are ACTIVE.
5. Adds the role. Roles the user already holds are kept — this is not the
   replace-set semantics of POST /tenants/{tenantId}/users/{userId}/roles.

Idempotency: re-appointing a user who already holds the role answers
409 rather than silently succeeding, so an operator learns the state

they are in.

Authorization: requires platform.users.appoint-tenant-administrator,
a platform-exclusive scope. Restricted to System Administration tenant (001) users on
PRIVATE_CLOUD / ON_PREMISE deployments.