organizations: admin surface for tenant orgs

New /organizations route under Tenancy. Lists every org in the current
tenant (via GET /api/v1/admin/organizations), with per-row Manage
members and Settings dialogs.

- Members dialog: invite by email, add restricted sub-user, change role,
  transfer ownership, remove member (owner removal honors the org's
  on_owner_removal policy server-side)
- Settings dialog: edit name, status (active/frozen/pending_deletion),
  and on_owner_removal policy
- app/lib/arcadia/organizations.ts: typed client for the new endpoints
- Nav entry added under Tenancy group

Tenant admins bypass per-org membership checks via the backend's
OrganizationContext plug, so the per-org REST endpoints work for any
org in the tenant without an explicit /admin/* surface.

app/routes.ts

@@ -22,6 +22,7 @@ export default [
   route("buckets", "routes/buckets.tsx"),
   route("monitoring", "routes/monitoring.tsx"),
   route("memberships", "routes/memberships.tsx"),
+  route("organizations", "routes/organizations.tsx"),
   route("networking", "routes/networking.tsx"),
   route("sso", "routes/sso.tsx"),
   route("announcements", "routes/announcements.tsx"),