[Epic]: Organization hierarchy and delegated administration

## Summary
Introduce a company → region → business-unit → team organization hierarchy with per-node policy (models, budget, residency) and scoped administration, replacing today's flat account/project model.

## Intent / Source of truth
Flat admin/user models break well before 10k seats. Buyers expect a hierarchy with per-node policy and scoped admins who manage their own team without platform-wide rights. Source: 2026-08-13 enterprise-readiness research pass — no hierarchy concept exists in lightbridge-authz today.

## Scope
- [ ] Organization hierarchy data model (company/region/BU/team, arbitrary depth)
- [ ] Policy inheritance and override resolution across the tree
- [ ] Scoped-admin roles limited to their subtree
- [ ] Migration of existing flat accounts/projects onto the hierarchy without breaking live budget enforcement

## Out of scope
- Cross-org (multi-tenant) hierarchy merging
- Self-service org restructuring UI (API/data model first)

## Verification
A policy set at a BU node is provably inherited by its teams and overridable per-team; a scoped admin's API calls are rejected outside their subtree; existing budget enforcement continues to pass its current test suite after migration.

## Risk assessment
Migrating live accounts risks breaking the already-shipped per-person budget enforcement (ADR-0021/0035 in ai-helm) if the migration path is not backward-compatible; requires a dry-run/shadow-mode step before cutover.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.