[frontend-contrib S23] auth-org backend capability (org-console prerequisite)

[rickylabs]

Part of #922

Scope

Versioned auth-org procedures (org get/list, members list/invite/remove, role set) in plugin-auth-core contracts + per-adapter implementation (better-auth organization plugin, workos; kv-oauth: capability absent). Named prerequisite for the org-management console — the frontend layer needs nothing new for it.

Design source: RFC #890 (rfc.md §5) + .llm/runs/plan-frontend-contrib--seed/design/canonical/ (rev 3).

Acceptance

• gate: contract + at least one adapter implementation + capability flag surfaced to PluginClientContext