perf(organizations): index membership scope export

[SadPossum]

Summary

• add a non-unique composite OrganizationId, Id membership index aligned with revision-pinned keyset export
• add additive PostgreSQL and SQL Server migrations with generated designers and snapshots
• cover EF model and migration operation shape, PostgreSQL catalog and 10,001-row keyset paging with revision drift, and SQL Server catalog shape

Scope

This is only the Organizations storage performance prerequisite for large-tenant identity-anchor cutover. It preserves the existing export contract and adds no public seam.

It does not remove BunkFy cutover source or retained-membership caps, replace the serial per-membership inspection N+1, or implement cutover streaming. Those remain separate BunkFy work.

Evidence

• eng/verify.ps1 -SkipDocker: synchronized solution, 0-warning/0-error build, both-provider migration drift, 324/324 unit tests, and vulnerability audit
• non-Docker integration tests: 2/2
• combined affected Docker provider matrix: 3/3 in 13 seconds
  • PostgreSQL exported 10,001 memberships in 51 keyset pages of at most 200 and rejected a stale revision after a separate writer changed the scope
  • PostgreSQL pre-existing lifecycle regression remained green
  • SQL Server verified the deployed ordered key columns are OrganizationId, Id
• boundary, repository-security, and repository-release gates passed
• git diff check and scoped whitespace verification for all touched/generated files passed

The canonical repository-wide formatter baseline reports unrelated pre-existing whitespace differences, so this PR claims scoped touched-file format cleanliness rather than a full-repository format cleanup.