fix(F1097): set org_id in Gin context for org-token callers (#1218)

[molecule-ai]

Summary

• Closes F1097 ([MEDIUM] F1097: org_id never set on context — canvas UI tokens always get org_id=NULL #1218)
• orgtoken.Validate now returns org_id (the org workspace UUID stored on org_api_tokens rows, populated by fix(auth): F1094 — requireCallerOwnsOrg reads org_id not created_by (#1200) #1212)
• Both call sites in wsauth_middleware.go — WorkspaceAuth and AdminAuth — call c.Set("org_id", orgID) after successful org-token validation

Root Cause

orgtoken.Validate returned only (id, prefix, err). Both middleware call sites populated org_token_id and org_token_prefix on the Gin context, but never org_id. Any downstream handler reading c.Get("org_id") (e.g. requireCallerOwnsOrg) received "" even for valid org tokens.

Fix

• Validate now returns (id, prefix, orgID string, err) — the SQL SELECT pulls org_id alongside id and prefix
• Both middleware call sites unpack the new orgID return value and call c.Set("org_id", orgID)
• orgID may be empty for pre-migration tokens minted before fix(auth): F1094 — requireCallerOwnsOrg reads org_id not created_by (#1200) #1212; requireCallerOwnsOrg already handles empty org_id by denying by default

Changes

File	Change
internal/orgtoken/tokens.go	Validate signature: add orgID to returns; SELECT org_id from org_api_tokens
internal/middleware/wsauth_middleware.go	Both call sites: unpack orgID, call c.Set("org_id", orgID)

Test plan

• Go unit tests pass (go test ./internal/orgtoken/... ./internal/middleware/...)
• CI green on staging

[molecule-ai]

Duplicate of PR #1232 (fix/f1097-org-id-context). Both branches are identical. Please review and merge #1232 instead.

[molecule-ai]

QA Review — PR #1239 (fix(F1097): set org_id in Gin context for org-token callers)

Quality: HIGH — Recommend approval once CI passes

Correct fix for F1097. orgtoken.Validate now returns orgID from the org_api_tokens row, and both middleware call sites (WorkspaceAuth + AdminAuth) populate c.Set("org_id", orgID) on the Gin context. Downstream handlers (including requireCallerOwnsOrg) will now correctly read the org UUID.

CONFLICTING / BASE BRANCH WARNING ⚠️
PR #1239 targets staging — which is now behind main (staging was merged to main via PR #1237 at 2026-04-21T02:50:10Z). This PR needs rebase onto main before merge. Same applies to PRs #1238 and #1240.

Migration safety: Empty org_id (pre-#1212 tokens) is handled by requireCallerOwnsOrg denying by default — correct Phase 32 posture.

Test plan items (Go unit tests + CI) appropriate. Recommend approval once base branch updated to main and CI passes.