fix: allow brand identity save without member profile

[bokelley]

Summary

• The brand-identity PUT endpoint no longer requires a member profile to exist. Users can save their logo and brand color as soon as they have an org, before creating a full profile.
• Falls back to org name for display name, and logo URL hostname for brand domain when no profile fields are available.
• Fixes unclaimed hosted_brands rows not getting claimed on update (COALESCE on workos_organization_id).
• Prevents domain squatting via logo URL by checking existing brand ownership before using logo hostname as brand domain.

Test plan

• Authenticated user with no profile can save brand identity (logo URL + color)
• Authenticated user with existing profile still works as before
• Saving brand with logo URL on a domain already claimed by another org returns appropriate error
• Updating an unclaimed hosted_brands row claims it for the current org
• Brand domain derivation priority: profile.primary_brand_domain > profile.contact_website hostname > logo_url hostname

🤖 Generated with Claude Code