fix(api,sdk): switch organizations with app token

[markwylde]

Summary

• add a bearer-token POST /token/organization endpoint that verifies the current app-issued JWT, validates target-org membership, and mints fresh org-scoped tokens
• default @darkauth/client switchOrganization() to the token switch flow while keeping authorize, hosted, and legacy silent modes explicit
• allow registered public SPA origins to call the new token organization endpoint and update the org-switching spec
• add focused API, CORS, and SDK test coverage for the token-switch behavior

Verification

• Not run

Notes

• This avoids using the same-origin/CSRF-protected session organization endpoint from cross-origin SPAs.
• A valid existing Atlas/DarkAuth token for the same client is treated as proof the app was already authorized; DarkAuth still validates active membership before minting target-org tokens.