B2B-5 · Organization entity + org roles (CASL) + committee/namespace migration

Part of the B2B epic (Fase 1 · item 1.2). Organizations become a first-class entity, decoupled from namespaces: **organization = people, namespace = content partition**. This benefits the main namespace too — committee working groups become organizations inside the public namespace, without partitioning content.

Current state (why an entity is needed):
- `NameSpace.users` is a flat user list with no roles (`server/auth/name-space/schemas/name-space.schema.ts:19-27`)
- Roles live in a loose map on the user (`server/users/schemas/user.schema.ts:24` → `role: { main: "admin" }`)
- `server/group/` groups **content** (verification requests under a claim), not people
- The committee exists only as a marketing page (`src/pages/committee-invitation-page.tsx`) — no data model

## What
- [ ] `Organization { name, slug, members: [{ user, role }], settings/plan }` schema + service + controller
- [ ] `NameSpace.organization` ref (a B2B client = an org that owns a private namespace)
- [ ] CASL subject + ability matrix separating *org* actions (invite, billing, settings) from *content* actions (`server/auth/ability/ability.factory.ts:20-73`)
- [ ] Migration: create the committee org in `main` + one org per existing namespace, moving `NameSpace.users`/`user.role` into `members`

## Out of scope (future issues)
Review-task assignment to a group, group-based visibility, org hierarchies.

**Effort:** ~2–2.5 SP · **Depends on:** — (parallel track with B2B-1..4) · **Blocks:** B2B-6, B2B-8