docs(api): document MSP cross-tenant access via ?account= parameter (#723)

Adds a new API guide covering the cross-tenant `?account=<tenant_id>`
query parameter that scopes calls to a specific tenant under an MSP
account. Includes setup steps for picking a user and generating a PAT,
how to retrieve tenant IDs via the MSP listing endpoint, read/write
examples, and auditing/security guidance.

Cross-references added from the Authentication guide, the MSP Portal
page, and the public-api token-creation page so the new guide is
discoverable from each entry point an MSP user is likely to hit.

src/pages/manage/for-partners/msp-portal.mdx

@@ -19,6 +19,10 @@ or inconvenient customer-specific URLs.
     <img src="/docs-static/img/manage/for-partners/msp-portal/tenant-switch.png" alt="tenant-switch" className="imagewrapper"/>
 </p>
 
+<Note>
+    Prefer to automate tenant operations? You can drive setup keys, networks, users and more across every tenant under your MSP account via the API — see [MSP API access](/api/guides/msp-api-access).
+</Note>
+
 ## How to Apply for an MSP Account?
 To apply for an MSP account, follow these steps:
 

src/pages/manage/public-api/index.mdx

@@ -61,6 +61,10 @@ Be aware that once you close the popup it is impossible to see the plain version
     It's important to keep your personal access tokens secure, as they can provide access to sensitive data and actions within your account. You should treat your personal access tokens like you would treat your password and never share them with anyone else.
 </Note>
 
+<Note>
+    **Using PATs across tenants under an MSP account.** A PAT issued to a real user inside an MSP account can act as a single key for automation across every tenant the user has access to — append `?account=<tenant_id>` to any API call to scope it to a specific tenant. Treat such a token accordingly: MFA on the underlying SSO identity, regular rotation, and a secrets manager on the caller side. See [MSP API access](/api/guides/msp-api-access) for the full setup.
+</Note>
+
 ### Using access tokens
 
 Once you have created an access token, you can use it to authenticate API requests to NetBird. See [NetBird API](/api/introduction) documentation for detailed usage.