fix(policy): defensive guard when req.route is undefined in organization subject resolver

[PierreBrisorgueil]

Problem

The organization subject guard checks req.route?.path but req.route may be undefined if called before routing completes. Returns false silently with no warning.

File: modules/organizations/policies/organizations.policy.js:18

Fix

registerDocumentSubject('organization', 'Organization', (req) => {
  if (!req.route?.path) {
    logger.warn('[policy] organization guard called before routing — treating as no-match');
    return false;
  }
  const p = req.route.path;
  return p.startsWith('/api/organizations') || p.startsWith('/api/admin/organizations');
});

Also

Add JSDoc in lib/middlewares/policy.js documenting that module route prefixes must be non-overlapping (first-match-wins on .startsWith()).