[feature] Add dedicated REST API endpoints for managing user organization memberships

Is your feature request related to a problem? Please describe.

Currently, there is no dedicated REST API endpoint to manage organization memberships (add, remove, or modify). Users must be added/modified through the superuser user detail endpoint (PUT /api/v1/users/user/{id}/), and removal requires changing the is_admin value in a way that is undocumented and unintuitive.

Describe the solution you'd like

Add dedicated REST API endpoints to manage organization membership:

• GET /api/v1/users/user/{user_id}/organization-membership/
• POST /api/v1/users/user/{user_id}/organization-membership/
• PUT/PATCH /api/v1/users/user/{user_id}/organization-membership/{org_id}/
• DELETE /api/v1/users/user/{user_id}/organization-membership/{org_id}/

Both approaches should support proper permission checks (organization managers, superusers only).

Describe alternatives you've considered

1. Continue using the indirect approach via the user detail endpoint with undocumented behavior
2. Document the existing behavior (changing is_admin to same value deletes membership) and consider it sufficient

Additional context

Current Issues:

• No clear way to remove a user from an organization via REST API
• The workaround (sending same is_admin value to delete) is undocumented and counter-intuitive
• Only superusers can manage memberships through the current endpoint
• Missing organization manager permissions checks for membership management
• The OrganizationUserSerializer exists in the codebase but is only used internally in the superuser serializer

Benefits:

• Clearer, more intuitive API for organization membership management
• Better permission control (allow org managers to manage memberships)
• Improved documentation and discoverability
• Consistency with REST API best practices
• Enables programmatic management of organization memberships

Start by tracing the existing superuser user detail endpoint and the OrganizationUserSerializer, which currently is used internally in the superuser serializer. Define the GET, POST, PUT/PATCH, and DELETE organization-membership endpoints and their organization-manager and superuser permission behavior. Done means memberships can be listed, added, modified, and removed through the documented REST API.