Organization context

A request acts on one organization. By default that is the organization the credential was minted against; send X-Org-Name with an organization handle to act on another. A user credential may name any organization its owner belongs to. A machine credential (OAuth client credentials) is issued to one organization and stays pinned to it: naming another is refused, never ignored.

Refusals carry a machine-readable code alongside error, because the remedies differ: org_forbidden means the caller is not a member of the named organization (ask an owner for an invitation), forbidden means they are a member but lack the role the action needs, insufficient_scope means the credential was not granted it, org_assertion_mismatch means a machine credential named an organization other than its own, org_deleted means the organization the credential itself is bound to has been deleted (no invitation or role reaches it again), and invalid_org_assertion (400) means the header was not a valid handle.