feat(phase-3): workstream 1 — Multi-Tenancy

Introduces full multi-tenant organization model to AgentIdP:

Schema:
- 6 migrations: organizations + organization_members tables; organization_id FK
  added to agents, credentials, audit_logs; PostgreSQL RLS policies on all three
  tables; system org seed + backfill

API:
- 6 new /api/v1/organizations endpoints (CRUD + members) gated by admin:orgs scope
- OPA scopes.json updated with 6 new org endpoint → admin:orgs mappings

Implementation:
- OrgRepository, OrgService, OrgController, createOrgsRouter
- OrgContextMiddleware: sets app.organization_id session variable so RLS enforces
  per-request org isolation at the database layer
- JWT payload extended with organization_id claim; auth.ts backfills org_system
  for backward-compatible tokens
- New error classes: OrgNotFoundError, OrgHasActiveAgentsError, AlreadyMemberError

Tests: 373 passing, 80.64% branch coverage, zero any types

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/repositories/AgentRepository.ts

@@ -16,6 +16,7 @@ import {
 /** Raw database row for an agent. */
 interface AgentRow {
   agent_id: string;
+  organization_id: string;
   email: string;
   agent_type: string;
   version: string;
@@ -36,6 +37,7 @@ interface AgentRow {
 function mapRowToAgent(row: AgentRow): IAgent {
   return {
     agentId: row.agent_id,
+    organizationId: row.organization_id,
     email: row.email,
     agentType: row.agent_type as IAgent['agentType'],
     version: row.version,
@@ -66,13 +68,15 @@ export class AgentRepository {
    */
   async create(data: ICreateAgentRequest): Promise<IAgent> {
     const agentId = uuidv4();
+    const organizationId = data.organizationId ?? 'org_system';
     const result: QueryResult<AgentRow> = await this.pool.query(
       `INSERT INTO agents
-         (agent_id, email, agent_type, version, capabilities, owner, deployment_env, status, created_at, updated_at)
-       VALUES ($1, $2, $3, $4, $5, $6, $7, 'active', NOW(), NOW())
+         (agent_id, organization_id, email, agent_type, version, capabilities, owner, deployment_env, status, created_at, updated_at)
+       VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'active', NOW(), NOW())
        RETURNING *`,
       [
         agentId,
+        organizationId,
         data.email,
         data.agentType,
         data.version,