[2a] Organization CRUD — admin API + UI

[andrmaz]

What to build

Expose full CRUD for the Organization model via an admin REST API (/api/admin/organizations) and a corresponding admin web page. All org records carry the tenant boundary that every downstream resource (users, sources, policies) will inherit.

Acceptance criteria

• Admin can create, read, update, and list organizations via API.
• Admin web page renders an organization list and create/edit form.
• API rejects requests from non-admin roles.
• Integration tests cover create + read paths.

Blocked by

• [1a] Project scaffolding + core schema #2 [1a] Project scaffolding + core schema

[andrmaz]

@cursoragent Start working on this

[cursor]

All tasks complete. Here's a summary of what was built:

API (apps/api/src/admin/)

• AdminRoleGuard — extends JwtAuthGuard, returns 401 for bad/missing tokens and 403 Forbidden for any non-admin role
• OrganizationService — findAll, findOne, create, update with proper 404 (not found) and 409 (name conflict on P2002) error handling
• OrganizationsController — four routes under GET/POST /api/admin/organizations and GET/PATCH /api/admin/organizations/:id, all guarded by AdminRoleGuard
• AdminModule — imports PrismaModule, wires controller + service; registered in AppModule

Tests — 29 new tests, 102 total, all green:

• Unit tests for every OrganizationService branch (findAll, findOne 404, create P2002, update race, re-throw)
• Integration tests for HTTP happy paths (create, list, get-by-id), auth rejection (401/403), 404, 409, and whitespace trimming

Web (apps/web/app/admin/organizations/)

• Server-rendered page.tsx with Suspense-wrapped org list and create form
• OrgTable.tsx — client component with inline edit toggle per row
• OrgForm.tsx — CreateOrgForm + EditOrgForm using useActionState for pending/error states
• actions.ts — Server Actions calling the backend API with revalidatePath
• api.ts — server-side fetch helpers using CORTEX_API_URL + CORTEX_ADMIN_TOKEN env vars (placeholder comment for when auth cookies are wired up)