Provision organization access through the runtime authority model

When an existing authenticated user has an application profile but lacks organization access, grant access through the authority relation that runtime authorization actually reads. Do not assume a legacy organization field remains authoritative.

Resolve exactly one identity and organization, use an idempotent grant upsert, and verify authentication identity, profile, grant, requested role, and active state with a separate read-only readback.