refactor(sitesvc): rename Org to Instance, refuse an unmigrated database

The signup form's JSON field becomes instance_name, and the pending-signup
document field with it. That collection is sitesvc-private and expires after
24 hours, so no migration is needed, but in-flight signups written before the
deploy will fail verification.

sitesvc/internal/mail/mail.go

@@ -150,7 +150,7 @@ func sanitizeHeader(v string) string {
 	return strings.NewReplacer("\r", " ", "\n", " ").Replace(v)
 }
 
-func (c Config) SendVerification(to, orgName, link string, ttl time.Duration) error {
+func (c Config) SendVerification(to, instanceName, link string, ttl time.Duration) error {
 	body := fmt.Sprintf(`Confirm your email to finish creating %s on Vantage.
 
 Open this link:
@@ -161,7 +161,7 @@ The link works once and expires in %d hours. Until you use it, no account
 exists nothing has been created and the address is not registered.
 
 If you did not request this, ignore this email and nothing will happen.
-`, orgName, link, int(ttl.Hours()))
+`, instanceName, link, int(ttl.Hours()))
 
 	return c.sendTo(to, "Confirm your Vantage organisation", body, "")
 }