refactor(sitesvc): rename Org to Instance, refuse an unmigrated database

The signup form's JSON field becomes instance_name, and the pending-signup
document field with it. That collection is sitesvc-private and expires after
24 hours, so no migration is needed, but in-flight signups written before the
deploy will fail verification.

sitesvc/cmd/main.go

@@ -28,6 +28,13 @@ func main() {
 	}
 	log.Printf("connected to MongoDB (database %q)", store.DatabaseName())
 
+	guardCtx, guardCancel := context.WithTimeout(context.Background(), 10*time.Second)
+	guardErr := store.RequireMigratedDatabase(guardCtx)
+	guardCancel()
+	if guardErr != nil {
+		log.Fatalf("database check failed: %v", guardErr)
+	}
+
 	if err := store.EnsureIndexes(); err != nil {
 		log.Fatalf("failed to ensure indexes: %v", err)
 	}