Extract organization CRUD out of the crud/__init__.py monolith

[akwasigroch]

Purpose

Continues the incremental split of the crud/__init__.py monolith (#2410 through #2458, most recently #2588 for Test Result) by moving the Organization CRUD functions into their own per-entity module, per the "split, don't grow" rule in apps/backend/AGENTS.md.

What Changed

New app/crud/organization.py holds get_organization, get_organizations, create_organization, update_organization and delete_organization, moved verbatim out of the # Organization CRUD section of crud/__init__.py, plus its own logger.

The get_session_variables debug helper moved with them. It sat at the top of the monolith but create_organization was its only caller — it reads back app.current_organization / app.current_user before and after the session-context reset so the log shows the GUCs really were cleared — so it belongs in this module.

create_organization's behaviour is untouched: it still calls reset_session_context(db) and skips RLS (an organization is the tenant, so there is nothing to scope it to yet), still expires the session, still returns the flushed object without a refresh, and still honours owner_user_id=None for internal callers that already supply the correct IDs in the schema. The module docstring now explains why.

Callers moved to the house pattern (from rhesis.backend.app.crud import organization as organization_crud): routers/organization.py, tests/backend/fixtures/test_setup.py and tests/backend/crud/test_transaction_management.py. In all three the bare crud name was used only for organization functions, so crud was dropped from their from rhesis.backend.app import crud, ... lines. A stale crud.get_organization doc reference in services/platform_key.py was updated to crud.organization.get_organization.

Note for the sibling extraction PRs open against the same file: this is the PR that also drops the now-unused imports from the top of crud/__init__.py — text from the sqlalchemy import on line 10 (only get_session_variables used it), the whole from rhesis.backend.app.database import reset_session_context line (only create_organization used it), and from uuid import UUID (only create_organization's signature used it). and_ and select stay; they are still used by the TestSet and Test sections. No other line in the import block was touched, reordered or reformatted.

crud/__init__.py drops 111 lines, from 1336 to 1225.

Additional Context

Pure refactor. Function bodies were moved byte-for-byte (verified by diffing the extracted blocks against the originals) — no signature, query or behaviour change, so the generated SQL is identical. The only pre-existing lint findings left in place are typing.Union unused in crud/__init__.py and the import-order plus unused fastapi.APIRouter findings in routers/organization.py, all of which are already present on main.

Testing

uv run pytest ../../tests/backend/security/ ../../tests/backend/crud/ ../../tests/backend/routes/test_organization.py ../../tests/backend/services/test_organization.py ../../tests/backend/auth/ -q from apps/backend — 1931 passed, 6 skipped (all pre-existing skips). Ruff check and format clean on every touched file apart from the pre-existing findings noted above.