Returns the effective policy state for every active tenant in the deployment in a single response. One JPQL aggregate query across the three tenant policy tables — no N+1 per-tenant fetches. Used by the Tenants Management Policies column.

Lock-state-aware shape: when the deployment is LOCKED, the allowsTenantOverride field is omitted from each element (uniform deployment-level state, no per-tenant differential). When UNLOCKED, every element carries the per-tenant template assignment.

Authorization: requires admin.tenant.list scope (same as /platform/tenants list).