Better Auth organization plugin adopted (two-role AC, creatorRole admin, no
owner tier, deletion disabled plugin-wide). Personal orgs auto-created at
signup via ensurePersonalOrg (direct inserts, hooks refuse all personal-org
mutations). Token invite links on top of the plugin — hashed, maxUses,
revocable, no email; redemption transactional with a guarded increment
(concurrent-redeem tested), existing member = full no-op, beta approval iff
the creating admin is approved at redemption time through the new single
promoteUserAccess path. organization_installations re-keys installs to orgs
((forge, installationId) unique = one install ↔ one org); worker resolves
installation→org→repos with no user assumptions and never auto-claims.
Idempotent backfill (scripts/migrate-orgs.ts) + moveInstallation op.
Server-fn classification list wired into the boundary test.
Routes are still flat — checkpoint 2 is the /:org/:repo URL rewrite.
