Recon Platform Backoffice

GET /api/admin/platform/summary exposes platform-admin inventory for the
Recon service.

The endpoint is gated by IAM platform_admin role propagation through the
gateway/JWT permission context. It reports:

• Bank connectivity coverage: bank accounts and imported transactions.
• Reconciliation coverage: reconciliation matches and suggested-match queues.
• Close controls: close checklist data, assignments, comments, anomalies, and
  audit log coverage.

Tenant registration approvals, package subscriptions, seats, and entitlements
remain owned by infranotes-iam.

Count Accuracy

Tenant-owned Recon tables use forced row-level security. The Backoffice summary
does not bypass tenant isolation for those tenant-owned tables. Non-tenant-owned
Recon tables can return exact global counts when available, while tenant-owned
tables are marked degraded with count_accuracy=estimated when exact global
aggregation is blocked and PostgreSQL table statistics are used instead.

Rollback: revert the endpoint commit. No migrations or datastore changes are
required.