fix(server): harden per-org settings migration and sweeps

Review follow-ups on e5363a6:

- MigrateSettingsOrg no longer guesses via the "default" slug. One org
  means stamp that org; zero orgs means synthesise Default; more than
  one means leave it alone and log, since guessing would hand one org
  another's SMTP config and ESO token.
- EnsureSettingsIndexes failure is now fatal. Without the unique index
  on org_id, GetSettings returns an arbitrary duplicate; without the one
  on the token hash, ResolveSecretsReadToken picks an arbitrary org.
- Name the token-hash index explicitly so it stops colliding with the
  legacy name DropOne targets, and exclude the empty string from the
  partial filter.
- Log retention: distinguish a missing run doc from a Mongo error, so a
  transient failure skips the directory rather than purging it at the
  30-day default.
- Offline sweep: fresh context per org, log-and-continue on a per-org
  error, plus a final pass for servers whose org no longer exists.
- ESO handler 401s on an empty token-derived org rather than querying
  org_id "".

server/cmd/main.go

@@ -39,8 +39,11 @@ func main() {
 		log.Printf("warning: failed to ensure secret indexes: %v", err)
 	}
 
+	// The unique indexes are a security property: duplicate settings docs make
+	// GetSettings return an arbitrary one, and duplicate ESO token hashes make
+	// ResolveSecretsReadToken pick an arbitrary org.
 	if err := services.EnsureSettingsIndexes(); err != nil {
-		log.Printf("warning: failed to ensure settings indexes: %v", err)
+		log.Fatalf("failed to ensure settings indexes: %v", err)
 	}
 
 	if err := services.EnsureWorkflowIndexes(); err != nil {