Harden organization creation API contract and permissions

[wauputr4]

Goal

Make the create organization path safe and predictable for the new onboarding flow, including permissions, validation, duplicate handling, and tests.

Scope

• Verify current /api/v1/org-admin/organizations behavior for normal console users vs superadmin/admin users.
• Confirm whether the new onboarding flow should create immediately, create as pending/unclaimed, or require review.
• Add/adjust validation for required fields, slug uniqueness, duplicate names, contact fields, and ownership/role assignment semantics.
• Ensure stable API error codes/statuses for frontend consumption.
• Add backend/API tests for success, duplicate, invalid, unauthorized, and permission-boundary cases.
• Update OpenAPI/docs if the contract changes.

Acceptance criteria

• Organization creation behavior is documented and covered by tests.
• Frontend can rely on stable validation and duplicate/conflict errors.
• Permission boundaries are explicit for public user, claimed org manager, admin, and superadmin.
• go test ./... and relevant OpenAPI checks pass, or skipped checks are documented.

Related

• Existing admin fields audit: Pre-release: Complete admin organization create/edit fields audit #42
• Auth/claim hardening: Pre-release: Harden auth and organization claim API behavior #41