Harden organization operation recovery

[SadPossum]

Summary

• persist privacy-minimized organization operation, invitation, enrollment, and replacement identities before sending so an unchanged intent can recover across a same-tab reload
• reconcile workspace onboarding by the server-owned operation/organization ID through access, refetch, and staff-profile completion
• preserve the same update operation ID and expected version when the write commits but its authoritative refetch fails
• fail closed on contradictory one-time-token receipts and retain the fenced identity for authoritative reconciliation
• load the full organization catalog in bounded pages, preserve selections beyond page 100, and isolate pending invite mutations when the workspace changes
• namespace retry state with the immutable bearer subject without treating any client-generated ID as authority

Verification

• rebased onto current web dev at 47fb39d3bee4962a96cd544c36189c8116adfb47
• local pnpm verify: 57 test files / 313 tests, typecheck, ESLint, and production build passed
• focused delayed workspace A to B completion and committed-write/refetch-failure replay regressions passed
• regenerated TypeScript contracts match the committed web OpenAPI output
• organization create/update/source retry shapes and workspace-staff-enrollment hasMore match the coordinated backend candidate
• git diff --check passed
• current-head hosted Validate, Security Baseline, and Trivy checks passed

Boundaries and rollout

• recovery is intentionally limited to sessionStorage in the same tab/session; it does not claim browser-restart or cross-tab durability
• the workspace catalog is bounded at 100 pages / 10,000 organizations and fails closed on no-progress pagination
• operation and source IDs are idempotency/resource coordinates only; authorization, subject, workspace, versions, claims, and tokens remain server-derived
• coordinated backend draft PR chore(deps): bump @radix-ui/react-popover from 1.1.19 to 1.1.23 #11 contains the Workspaces withdrawal consumer, out-of-order recovery, terminal redaction, and migration hardening; it is review evidence only and is not canonical, released, or deployed
• promotion remains blocked on backend PR chore(deps): bump @radix-ui/react-popover from 1.1.19 to 1.1.23 #11 release gates, including Staff replay correlation, single-version worker cutover, migration/catalog approval, load proof, and deployed smoke
• keep this draft coordinated with [codex] Harden workspace onboarding withdrawal recovery BunkFy.Backend#11 and run the paired generated-contract, lost-response, withdrawal, old-tab, and post-cutover smoke before promotion

The original withdrawal interaction is already present on the canonical web branch; this draft is recovery, scale, and actor-switch hardening rather than proof that the backend rollout is complete.