feat: add authorization policies

[vinimachadosantana]

What

Adds Pundit policies for organisations, wires enforcement into the base controller, and adds policy and cross-tenant request specs.

Why

Authentication proves who someone is, it says nothing about what they may touch. Without policies, any signed-in user could read any organisation by guessing an ID.

How

• Scope first, then authorize. Checking permission on an already-loaded record is the classic multi-tenant leak.
• verify_authorized and verify_policy_scoped raise when an action forgets to authorise.
• Cross-tenant access returns 404, not 403, so responses can't be used to enumerate which organisation IDs exist.
• The policy spec covers admin, member and non-member.

Testing

• Policy specs for all three roles
• Request spec proves another tenant's organisation returns 404
• RuboCop and Brakeman clean