Tenant management API rejects embedded approval settings

[bokelley]

Local embedded-storefront E2E showed that the tenant management PATCH endpoint rejects approval settings that the embedding storefront wants to push.

Request shape from agentic-api:

{
  "creative_approval": "auto",
  "media_buy_approval": "auto"
}

Observed salesagent response/log:

422 Request Validation Error: UpdateTenantRequest
creative_approval: Extra inputs are not permitted
media_buy_approval: Extra inputs are not permitted

Expected:

• Managed/embedded tenants need a supported API path to set the storefront-controlled creative/media-buy approval behavior, or the tenant-management OpenAPI should expose the canonical fields that replace these.
• If these fields are intentionally not supported anymore, we need the replacement contract documented so the embedding UI does not drift.

Impact:

• The storefront can still enforce local auto/manual behavior before forwarding, but the salesagent tenant itself remains out of sync and logs noisy 422s during setup/update.