Add portal user

Creates a Supabase Auth account scoped to this tenant. The user will receive a password-reset email and can then sign in at /portal/login.