refactor(sitesvc): rename Org to Instance, refuse an unmigrated database

The signup form's JSON field becomes instance_name, and the pending-signup
document field with it. That collection is sitesvc-private and expires after
24 hours, so no migration is needed, but in-flight signups written before the
deploy will fail verification.

sitesvc/internal/models/models.go

@@ -15,7 +15,7 @@ import (
 type PendingSignup struct {
 	ID           bson.ObjectID `bson:"_id,omitempty"`
 	PendingID    string        `bson:"pending_id"`
-	OrgName      string        `bson:"org_name"`
+	InstanceName string        `bson:"instance_name"`
 	Email        string        `bson:"email"`
 	PasswordHash string        `bson:"password_hash"`
 	TokenHash    string        `bson:"token_hash"`