When tenant_id is provided, runs reconciliation for that
tenant only and returns a single-item page. Otherwise iterates
every active tenant via ReconciliationService.run_for_all.
The endpoint is read-only and NEVER publishes
BILLING_RECONCILIATION_FAILED events — only the cadence worker
is allowed to do that.
Args:
tenant_id: Optional tenant id filter.
page: 1-indexed page number.
page_size: Items per page (default 50, max 500).
user: Admin user (enforced by dependency).
session: Database session.
Returns:
A dict with total, page, page_size, items.