feat(core): add TenantContext middleware and active organization endpoint

[geoffjay]

Adds multi-tenant request isolation infrastructure:

• TenantContext extractor (middleware/tenant.rs) — resolves session → user → active org per-request; returns 401 for missing/expired sessions and 403 if no active organization is set. Designed to forward organization_id as X-Tenant-ID to downstream services.
• PUT /users/me/active-organization (api/users.rs) — validates the requesting user is a member of the target org (403 if not), then updates active_organization_id. Returns the updated user profile without password_hash.
• 4 endpoint tests: success, not-a-member (403), unauthenticated (401), cross-user org isolation

Closes #216

[geoffjay]

This change is part of the following stack:

• feat(core): scaffold agentd-core service #1058
  • feat(core): add entity module stubs, migration runner, and Storage wrapper #1059
    • feat(core): implement initial sea-orm migration for core service schema #1060
      • feat(core): define SeaORM User entity with has_many relations #1061
        • feat(core): define SeaORM Session entity with belongs_to User #1062
          • feat(core): define Organization and Membership entities with many-to-many relations #1063
            • feat(core): add SeaORM integration tests for entity relations #1064
              • feat(core): add OrganizationStorage and MembershipStorage #1066
                • feat(core): add UserStorage with argon2 password hashing and username migration #1067
                  • feat(core): add authentication endpoints with SQLite-backed sessions #1068
                  • feat(core): add TenantContext middleware and active organization endpoint #1069 ◀
                  • feat(core): add user and organization management API endpoints #1070
                  • feat(cli): add auth and org commands for core service #1071
                  • feat(core): add API gateway proxy for downstream service routing #1072

_{Change managed by git-spice.}