fix(topbar): resolve theme + tenant-switch endpoints via lurl() to avoid relative URL breakage

Both endpoints were declared as bare relative paths ("admin/users/theme",
"admin/users/switch-tenant") and handed to postForm(), which normalizes
through `new URL(value, window.location.href)`. On a deep route like
/de/admin/permissions that resolves to /de/admin/admin/users/theme —
404 → 302 to error page → HTML response → JSON.parse throws → the theme
toggle reverts visually. The tenant switcher had the same latent bug.

- Topbar renders data-theme-url and data-switch-tenant-url via lurl(), so
  both carry the locale-aware root-anchored path.
- Tenant switcher reads data-switch-tenant-url from the switcher root
  (matching the theme-menu convention) and passes it through to
  switchTenant(); fail-fast warning if the attribute is missing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/js/components/app-tenant-switcher.js

@@ -18,14 +18,14 @@ const setPending = (link, pending) => {
   }
 };
 
-const switchTenant = async (link) => {
+const switchTenant = async (link, switchUrl) => {
   const tenantId = link.dataset.switchTenant;
   const csrfKey = link.dataset.csrfKey;
   const csrfToken = link.dataset.csrfToken;
   const errorMessage = link.dataset.errorMessage || 'Failed to switch tenant';
 
-  if (!tenantId || !csrfKey || !csrfToken) {
-    warnOnce('UI_DATA_MISSING', 'Missing tenant ID or CSRF token', { module: 'tenant-switcher' });
+  if (!tenantId || !csrfKey || !csrfToken || !switchUrl) {
+    warnOnce('UI_DATA_MISSING', 'Missing tenant ID, CSRF token, or switch URL', { module: 'tenant-switcher' });
     return;
   }
 
@@ -33,7 +33,7 @@ const switchTenant = async (link) => {
   setPending(link, true);
 
   try {
-    const data = await postForm('admin/users/switch-tenant', {
+    const data = await postForm(switchUrl, {
       tenant_id: tenantId,
       [csrfKey]: csrfToken
     });
@@ -71,11 +71,20 @@ export const initTenantSwitcher = (root = document, options = {}) => {
     return { destroy: () => {} };
   }
 
+  // Endpoint is rendered server-side via lurl() so it carries the locale-aware
+  // absolute path. Passing a relative path to postForm would resolve against
+  // window.location.href and break on deep routes like /de/admin/tenants/edit/...
+  const switchUrl = (switcherRoot instanceof HTMLElement ? switcherRoot.dataset.switchTenantUrl : '') || '';
+  if (!switchUrl) {
+    warnOnce('UI_DATA_MISSING', 'Missing data-switch-tenant-url on tenant switcher root', { module: 'tenant-switcher' });
+    return { destroy: () => {} };
+  }
+
   const cleanupFns = [];
   tenantLinks.forEach(link => {
     const onClick = (e) => {
       e.preventDefault();
-      switchTenant(link);
+      switchTenant(link, switchUrl);
     };
     link.addEventListener('click', onClick);
     cleanupFns.push(() => link.removeEventListener('click', onClick));