Payroll Platform Backoffice

GET /api/admin/platform/summary exposes platform-admin inventory for the
Payroll service.

The endpoint is gated by IAM platform_admin role propagation through the
gateway/JWT auth context. It reports:

• Workforce coverage: payroll principals, employees, time entries, and
  approvals.
• Payroll processing coverage: pay periods, payroll runs, payroll records, and
  Payroll-to-GL reconciliation state.
• Benefits and deductions coverage: benefit plans, employee elections,
  deductions, and garnishments.
• Tax compliance coverage: tax jurisdictions, calculations, filings, W-2/1099
  documents, and electronic filing submissions.
• Payment coverage: payment transactions, ACH files, payment reconciliations,
  and on-demand advances.
• Industry reporting coverage: certified payroll, Davis-Bacon projects, worker
  classification, and reporting tables.

Tenant registration approvals, package subscriptions, seats, and entitlements
remain owned by infranotes-iam.

Count Accuracy

Payroll tenant tables include tenant_id in the current migration set but do
not force row-level security. Exact counts are available only for the hardcoded
summary table allowlist. If a table later enables forced row-level security, the
summary keeps tenant isolation intact by returning PostgreSQL table statistics
with status=degraded and count_accuracy=estimated.

Rollback: revert the endpoint commit. No migrations or datastore changes are
required.