Build operator organization management

Add the first complete internal administration flow for organizations: paginated list, creation, details, rename, and change history. Scope and constraints: - Reuse Organizations commands/queries and shared Maud components. Add the missing list query, bounded native pagination, form validation/repopulation, audit reasons, conflict handling, and meaningful actor labels. - Connect browser sessions to application permissions without depending on or broadening the demo bearer adapter. Add shared operator request/CSRF/nav/error patterns rather than one-off controller checks. - Revalidate current session, user/credential state, configured admin project, assignment and role in the same transaction as mutations. Serialize authorization changes against writes so a stale context cannot mutate after revocation. - Preserve actor/request IDs and atomic state/history/outbox capture; historical snapshots remain explicit. No delete operation, customer API, user provisioning, or unrelated identity protocols. - All flows work with JavaScript disabled and both themes. Keep the clean UI established in cab1c44. - Repository begins clean; do not commit or change production services. Leave the existing dev server on 8800/Vite5173 alone; test with dedicated ports and fresh synthetic databases. Acceptance: - An authorized operator can list, create, view, rename, and inspect an organization's history without JavaScript; navigation and pagination are native and bounded. - Validation errors retain input and identify fields. Stale edits produce an explicit conflict without overwriting data; version/audit reason behavior is tested. - Anonymous, unassigned, revoked/expired, cross-realm and invalid-CSRF requests cannot read/mutate protected resources; authorization is enforced by application transactions, not just HTTP. - Tests verify actual actor/request attribution and atomic history/outbox writes, pagination boundaries, HTML escaping, and concurrent revocation/update behavior. - Formatting, strict Clippy, Rust/Python/asset checks, synthetic integration and real-browser gates pass. Document scope and remaining limits. Implemented milestones: - BrowserState now shares operator/CSRF handling; CookiePolicy, operator navigation and error pages are reused across authentication and organization controllers. - Browser Context carries an opaque session reference. Database read/write entry points revalidate the same canonical admin predicate; mutations acquire owner-performed shared locks across session/account/credential/project/assignment/role dependencies and hold them through commit. Migration 0003 adds that function, realm-scoped principal label reads, and the organization pagination index; existing migrations remain unchanged. - Organization listing uses bounded name/UUID keyset cursors with native previous/next links; creation, details, rename and chronological history use existing services. Actor labels accompany stable principal/request IDs. Stale edits preserve draft/version and disable save until explicit reload. - Seven new synthetic integration tests pass, including both concurrent authorization orderings, stale-context/credential/expiry checks, actor/request attribution, validation/conflicts/rollback, cross-realm/CSRF boundaries, duplicate-name/Unicode pagination and reverse navigation. Existing suites pass after moving common operator/HTTP fixture helpers into tests/support/operator.rs. - Real Chrome organization journeys now run inside the existing isolated operator fixture in all four theme/JavaScript combinations; create/rename/history/pagination, escaping, form errors, two-tab conflicts and narrow-screen overflow pass. Final validation is complete: Cargo formatting, strict workspace/all-target/all-feature Clippy, ordinary tests, all 53 non-browser Rust tests through the synthetic helper, five Python tooling tests, asset checks/build, and the complete browser gate pass. The existing eight asset-mode/theme/JS cases pass; the four operator theme/JS journeys now also exercise the full organization flow. List/detail/form/history screenshots were visually inspected. New-file whitespace/private-content checks pass. Owned test processes released their ports; no commits, production changes, or interactive operator-data mutations were made. Documentation is in docs/organizations.md, with README/authentication/frontend guidance updated. It records migration/restart instructions, canonical transaction authority, current actor-label lookup, duplicate-name/live-pagination semantics, explicit draft/conflict behavior, and the prototype-only bearer API boundary. Remaining limits: no delete, search, name uniqueness/idempotency API, memberships/customer provisioning, granular role editor, or general temporal reconstruction. Changes remain uncommitted on feature/add-organization-management.