Temporarily disables crypto and login capabilities for the tenant. Admin read access
is preserved. Publishes a signed status envelope to Redis and emits an admin audit event.

A reason is mandatory. Suspension is the transition that removes a

paying customer's capability and the one a customer disputes, so the operator's
justification is recorded verbatim on the admin audit event and signed with it. The
sibling verbs activate and reactivate take no body: both restore
capability and generate no grievance to answer.

Omitting the reason, or sending it blank or whitespace-only, is refused with 400 application/problem+json and the tenant's status is unchanged. A

request carrying no Content-Type, or a non-JSON one, is refused with
415 before the body is read at all.