#1038 Drop unused tenant_client_keys.suspended_at

Since #908 the tenant state is status/deactivated_at/deactivated_by with the reason in suspended_reason. Nothing reads or writes tenant_client_keys.suspended_at (submodule-aware grep 2026-10-20). Drop it with a migretti migration (core 01KCZQ3CES6QMA7RZTF2YZ3KBH added it), and consider renaming suspended_reason to deactivated_reason.