refactor(server): rename Org to Instance

Adds migration 0004_org_to_instance, the ScopedCollections list, the
AssertNoScopedCollectionMissed boot check, and moves EnsureAuthIndexes into
its own file.

Two ordering constraints the rename exposed, both now enforced and commented:

- 0004 must run BEFORE EnsureAuthIndexes. The index builder creates
  instances.slug, which would create an empty instances collection and make
  0004 refuse to rename orgs onto an existing target.
- Migrations 0001 to 0003 run BEFORE 0004 and still read and write org_id, so
  they use a private legacyOrg struct rather than shared/models.

server/internal/checker/checker.go

@@ -12,7 +12,6 @@ import (
 	"time"
 )
 
-
 const (
 	TypeHTTP = "http"
 	TypeTCP  = "tcp"
@@ -20,7 +19,6 @@ const (
 	TypeTLS  = "tls"
 )
 
-
 type Spec struct {
 	Type           string
 	URL            string
@@ -30,11 +28,10 @@ type Spec struct {
 	ExpectedStatus int
 	Keyword        string
 	TLSWarnDays    int
-	Insecure       bool 
+	Insecure       bool
 	TimeoutSec     int
 }
 
-
 type Result struct {
 	Up         bool
 	LatencyMs  int
@@ -50,7 +47,6 @@ func (s Spec) timeout() time.Duration {
 	return time.Duration(t) * time.Second
 }
 
-
 func Run(ctx context.Context, s Spec) Result {
 	switch s.Type {
 	case TypeHTTP:
@@ -77,7 +73,7 @@ func runHTTP(ctx context.Context, s Spec) Result {
 	}
 	client := &http.Client{Timeout: s.timeout()}
 	if s.Insecure {
-		client.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}} 
+		client.Transport = &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}
 	}
 	start := time.Now()
 	req, err := http.NewRequestWithContext(ctx, method, s.URL, nil)
@@ -156,9 +152,6 @@ func runTLS(ctx context.Context, s Spec) Result {
 
 func msSince(t time.Time) int { return int(time.Since(t).Milliseconds()) }
 
-
-
-
 func runICMP(ctx context.Context, s Spec) Result {
 	dst, err := net.ResolveIPAddr("ip4", s.Host)
 	if err != nil {
@@ -188,18 +181,18 @@ func runICMP(ctx context.Context, s Spec) Result {
 		if err != nil {
 			return Result{LatencyMs: msSince(start), Message: "no reply"}
 		}
-		
+
 		if n < 28 || peer.String() != dst.String() {
 			continue
 		}
-		if reply[20] == 0 { 
+		if reply[20] == 0 {
 			return Result{Up: true, LatencyMs: msSince(start)}
 		}
 	}
 }
 
 func icmpEcho(id, seq int) []byte {
-	
+
 	b := []byte{8, 0, 0, 0, byte(id >> 8), byte(id), byte(seq >> 8), byte(seq)}
 	cs := icmpChecksum(b)
 	b[2] = byte(cs >> 8)