- login(): check platformRoles before membership validation; fallback to first active tenant for superset admins - refreshTokens(): allow refresh for superset admins even without memberships - tenantMiddleware: skip tenantPool resolution when tenantId is empty for superset admins