feat(server): org-scope service layer + handlers + org admin API

Threads org_id through every admin-facing service function (servers, keys,
assignments, secrets, workflows/steps/runs, monitors, channels, audit),
adds RequireRole middleware, and wires /api/org user + OIDC management
routes. Agent/scheduler paths keep unique-key signatures and resolve org
from the loaded record; internal-only helpers (getServerByID,
getRunByID, getMonitorByID) preserve those call sites.

server/cmd/main.go

@@ -39,10 +39,16 @@ func main() {
 		log.Printf("warning: failed to ensure workflow indexes: %v", err)
 	}
 
-	if created, updated, err := services.SeedDefaultSteps(); err != nil {
-		log.Printf("warning: failed to seed default steps: %v", err)
+	if orgIDs, err := services.ListOrgIDs(); err != nil {
+		log.Printf("warning: failed to list orgs for default step seeding: %v", err)
 	} else {
-		log.Printf("default steps seeded: %d created, %d updated", created, updated)
+		for _, orgID := range orgIDs {
+			if created, updated, err := services.SeedDefaultSteps(orgID); err != nil {
+				log.Printf("warning: failed to seed default steps for org %s: %v", orgID, err)
+			} else {
+				log.Printf("default steps seeded for org %s: %d created, %d updated", orgID, created, updated)
+			}
+		}
 	}
 
 	services.StartLogSweeper()