fix(topbar): resolve theme + tenant-switch endpoints via lurl() to avoid relative URL breakage

Both endpoints were declared as bare relative paths ("admin/users/theme",
"admin/users/switch-tenant") and handed to postForm(), which normalizes
through `new URL(value, window.location.href)`. On a deep route like
/de/admin/permissions that resolves to /de/admin/admin/users/theme —
404 → 302 to error page → HTML response → JSON.parse throws → the theme
toggle reverts visually. The tenant switcher had the same latent bug.

- Topbar renders data-theme-url and data-switch-tenant-url via lurl(), so
  both carry the locale-aware root-anchored path.
- Tenant switcher reads data-switch-tenant-url from the switcher root
  (matching the theme-menu convention) and passes it through to
  switchTenant(); fail-fast warning if the attribute is missing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

templates/partials/app-topbar.phtml

@@ -85,7 +85,7 @@ $moduleTopbarSlots = is_array($moduleSlots['topbar.right_item'] ?? null) ? $modu
         ?>
       <?php endforeach; ?>
       <?php if ($canSwitchTenant): ?>
-        <li data-app-component="tenant-switcher" data-tenant-switcher data-tooltip="<?php e(t('Tenant')); ?>" data-tooltip-pos="bottom">
+        <li data-app-component="tenant-switcher" data-tenant-switcher data-switch-tenant-url="<?php e(lurl('admin/users/switch-tenant')); ?>" data-tooltip="<?php e(t('Tenant')); ?>" data-tooltip-pos="bottom">
           <details class="dropdown app-topbar-tenant-menu" data-summary-chevron="none">
             <summary aria-label="<?php e(t('Switch tenant')); ?>" title="<?php e($tenantLabel); ?>">
               <i class="bi bi-building" aria-hidden="true"></i>
@@ -127,7 +127,7 @@ $moduleTopbarSlots = is_array($moduleSlots['topbar.right_item'] ?? null) ? $modu
         <details class="dropdown app-topbar-user-menu" data-summary-chevron="none" data-app-component="theme-controls"
           <?php if ($allowUserTheme): ?>
             data-theme-menu
-            data-theme-url="admin/users/theme"
+            data-theme-url="<?php e(lurl('admin/users/theme')); ?>"
             data-csrf-key="<?php e($csrfKey); ?>"
             data-csrf-token="<?php e($csrfToken); ?>"
           <?php endif; ?>>