GSA traffic forwarding profile user/group assignment shows "temporarily unavailable" for all 3 profiles; backing service principals missing

Global Secure Access user and group assignment on all three default traffic forwarding profiles shows "temporarily unavailable" and has never worked. Root cause identified: the profile backing service principals do not exist in the tenant. Requesting a backend re-provision of these SPs.

Evidence gathered via Graph (beta and v1.0):

1. GET /beta/networkAccess/tenantStatus returns onboardingStatus: onboarded, onboardingErrorMessage: null.
2. GET /beta/networkaccess/forwardingProfiles returns all three default profiles, state: enabled, each with a servicePrincipal reference.
3. GET /v1.0/servicePrincipals/{id} returns 404 Request_ResourceNotFound for all three backing SPs. None appear in Enterprise applications (checked with the "All applications" filter).
4. Affected appIds: eeb422fa-f490-4dbf-a1d7-9eea09648a00 (Microsoft 365), fc54344a-4028-4f64-b219-be825b729175 (Private), 075900dc-44c3-4ced-a401-bba5d923be2c (Internet).
5. POST /beta/networkAccess/microsoft.graph.networkaccess.onboard returns 409 Conflict, "The tenant has already been onboarded," so re-onboard cannot recreate the SPs.

Admin account is Global Administrator, so the role-based cause (missing Application Administrator) does not apply. Tenant was enrolled in GSA during the preview phase; suspected orphaned state where the onboarded flag is set but the downstream backing apps were never provisioned or were cleaned up. Admin-side onboard is blocked by the conflict, so this requires a backend reset.

Request: re-provision the three traffic forwarding profile backing service principals for the tenant.