- Add is_hub_admin() and resolve_tenant_id_required() to core/security - hub_admin resolves tenant from company or uses None as global sentinel - Update routes and services to skip tenant filter when tenant_id is None - UserService accepts is_hub_admin flag for cross-tenant user management - get_my_companies returns all companies for hub_admin without tenant restriction