Learner auth flows stay on the learner domain.

Active tenant branding updates buttons, links, and shell styling.

Multi-tenant memberships can switch context without exposing admin UI.