fix(security): improve tenant ID resolution and error handling for hub_admin access

backend/api/v1/modules/core/users/service.py

@@ -580,7 +580,7 @@ class UserService:
         con ``X-Tenant-Override``; activos desde users-with-info del Hub si hay token;
         inactivos y fallback de conteos en BD local.
         """
-        max_users_allowed = 0
+        max_users_allowed: Optional[int] = None  # None = sin cuota (hub_admin ilimitado)
         hub_max_ok = False
         active_users = 0
         active_from_hub = False
@@ -600,8 +600,8 @@ class UserService:
                         lic_body = lic_resp.json()
                         if lic_body.get("valid"):
                             raw_max = lic_body.get("max_users")
-                            # max_users=null → hub_admin sin cuota; usamos 0 como sentinel
-                            max_users_allowed = int(raw_max) if raw_max is not None else 0
+                            # max_users=null → hub_admin sin cuota; None indica ilimitado
+                            max_users_allowed = int(raw_max) if raw_max is not None else None
                             hub_max_ok = True
 
                     users_resp = client.get(
@@ -647,9 +647,14 @@ class UserService:
         )
 
         total_users = active_users + inactive_users
-        users_available = max(0, max_users_allowed - active_users)
+        # Cuando max_users_allowed es None la cuota es ilimitada (hub_admin)
+        users_available = (
+            max(0, max_users_allowed - active_users)
+            if max_users_allowed is not None
+            else None
+        )
         usage_percentage = (
-            (active_users / max_users_allowed * 100) if max_users_allowed > 0 else 0
+            (active_users / max_users_allowed * 100) if max_users_allowed else 0.0
         )
 
         return {