#659 Dual implementations of suspend/reactivate - consolidation review

Two different places implement suspension: engine/security/platform.py (deactivate_tenant/reactivate_tenant for API) and engine/platform_core/tools/tenant.py (suspend/reactivate for internal tools). Platform uses status='deactivated', tools use suspended_at. Intentionally separate for system admin vs tenant admin logic - review if consolidation needed.