fix(auth): harden tenant admin API key boundaries

[bokelley]

What changed

• Reject tenant-issued WorkOS API keys from every platform-global admin route.
• Add one explicit tenant-admin middleware for audited, exact-organization routes.
• Apply that exception only to the read-only GET /api/admin/orgs/:orgId/invite-products endpoint.
• Keep member-profile mutations and global billing operations restricted to static or SSO platform administrators.
• Add route-level regression coverage for same-tenant, cross-tenant, permission, static-admin, and SSO-admin behavior.

Why

Organization owners can issue WorkOS keys with admin:*. The shared admin middleware previously interpreted that tenant permission as platform-wide authority, allowing an organization-issued key to reach cross-organization billing and administration behavior.

The authorization boundary now treats every WorkOS API key as tenant-scoped. Tenant access must be opted into by a specifically audited route and bound to the literal target organization.

Impact

• Tenant WorkOS API keys can no longer call platform-global admin endpoints.
• Static ADMIN_API_KEY callers and SSO platform administrators retain existing platform access.
• Tenant keys with admin:read or admin:* retain access to their own organization’s read-only invite-products endpoint.
• No package or lockfile changes.

Validation

• Security expert gate: clean
• Testing expert gate: clean
• Quality expert gate: clean
• Full server unit suite: 317 files passed; 4,735 tests passed; 30 skipped
• Focused security matrix: 77/77 passed
• TypeScript: passed
• Semgrep: 0 findings
• git diff --check: passed