feat(phase-3): workstream 1 — Multi-Tenancy

Introduces full multi-tenant organization model to AgentIdP:

Schema:
- 6 migrations: organizations + organization_members tables; organization_id FK
  added to agents, credentials, audit_logs; PostgreSQL RLS policies on all three
  tables; system org seed + backfill

API:
- 6 new /api/v1/organizations endpoints (CRUD + members) gated by admin:orgs scope
- OPA scopes.json updated with 6 new org endpoint → admin:orgs mappings

Implementation:
- OrgRepository, OrgService, OrgController, createOrgsRouter
- OrgContextMiddleware: sets app.organization_id session variable so RLS enforces
  per-request org isolation at the database layer
- JWT payload extended with organization_id claim; auth.ts backfills org_system
  for backward-compatible tokens
- New error classes: OrgNotFoundError, OrgHasActiveAgentsError, AlreadyMemberError

Tests: 373 passing, 80.64% branch coverage, zero any types

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app.ts

@@ -16,16 +16,19 @@ import { AgentRepository } from './repositories/AgentRepository.js';
 import { CredentialRepository } from './repositories/CredentialRepository.js';
 import { TokenRepository } from './repositories/TokenRepository.js';
 import { AuditRepository } from './repositories/AuditRepository.js';
+import { OrgRepository } from './repositories/OrgRepository.js';
 
 import { AuditService } from './services/AuditService.js';
 import { AgentService } from './services/AgentService.js';
 import { CredentialService } from './services/CredentialService.js';
 import { OAuth2Service } from './services/OAuth2Service.js';
+import { OrgService } from './services/OrgService.js';
 
 import { AgentController } from './controllers/AgentController.js';
 import { TokenController } from './controllers/TokenController.js';
 import { CredentialController } from './controllers/CredentialController.js';
 import { AuditController } from './controllers/AuditController.js';
+import { OrgController } from './controllers/OrgController.js';
 
 import { createAgentsRouter } from './routes/agents.js';
 import { createTokenRouter } from './routes/token.js';
@@ -33,10 +36,12 @@ import { createCredentialsRouter } from './routes/credentials.js';
 import { createAuditRouter } from './routes/audit.js';
 import { createHealthRouter } from './routes/health.js';
 import { createMetricsRouter } from './routes/metrics.js';
+import { createOrgsRouter } from './routes/organizations.js';
 
 import { errorHandler } from './middleware/errorHandler.js';
 import { createOpaMiddleware } from './middleware/opa.js';
 import { metricsMiddleware } from './middleware/metrics.js';
+import { createOrgContextMiddleware } from './middleware/orgContext.js';
 import { createVaultClientFromEnv } from './vault/VaultClient.js';
 import { RedisClientType } from 'redis';
 import path from 'path';
@@ -96,6 +101,7 @@ export async function createApp(): Promise<Application> {
   // eslint-disable-next-line @typescript-eslint/no-unnecessary-type-assertion
   const tokenRepo = new TokenRepository(pool, redis as RedisClientType);
   const auditRepo = new AuditRepository(pool);
+  const orgRepo = new OrgRepository(pool);
 
   // ────────────────────────────────────────────────────────────────
   // Optional integrations
@@ -113,6 +119,7 @@ export async function createApp(): Promise<Application> {
   const auditService = new AuditService(auditRepo);
   const agentService = new AgentService(agentRepo, credentialRepo, auditService);
   const credentialService = new CredentialService(credentialRepo, agentRepo, auditService, vaultClient);
+  const orgService = new OrgService(orgRepo, agentRepo);
 
   const privateKey = process.env['JWT_PRIVATE_KEY'];
   const publicKey = process.env['JWT_PUBLIC_KEY'];
@@ -142,6 +149,14 @@ export async function createApp(): Promise<Application> {
   const tokenController = new TokenController(oauth2Service);
   const credentialController = new CredentialController(credentialService);
   const auditController = new AuditController(auditService);
+  const orgController = new OrgController(orgService);
+
+  // ────────────────────────────────────────────────────────────────
+  // Org context middleware — sets PostgreSQL session variable app.organization_id
+  // Must run after auth (so req.user is populated) and before route handlers.
+  // Applied globally here; routes that don't require auth skip it gracefully.
+  // ────────────────────────────────────────────────────────────────
+  app.use(createOrgContextMiddleware(pool));
 
   // ────────────────────────────────────────────────────────────────
   // Routes
@@ -161,6 +176,7 @@ export async function createApp(): Promise<Application> {
   );
   app.use(`${API_BASE}/token`, createTokenRouter(tokenController, opaMiddleware));
   app.use(`${API_BASE}/audit`, createAuditRouter(auditController, opaMiddleware));
+  app.use(`${API_BASE}/organizations`, createOrgsRouter(orgController, opaMiddleware));
 
   // ────────────────────────────────────────────────────────────────
   // Dashboard static assets (served from dashboard/dist/)