Support orgless OAuth clients

[markwylde]

Summary

• Add a per-client require_organization_selection flag for OAuth authorization.
• Skip org selection, org binding, and org token claims for clients that opt out.
• Expose the setting in the admin client Security tab.
• Hide the hosted authorize organization picker for orgless clients and make selected org radio rows clearer.

Verification

• pnpm --filter @DarkAuth/api test -- --test-name-pattern "token redeems orgless|createClient and updateClient enforce key delivery|authorize finalization allows"
• pnpm --filter @DarkAuth/user-ui test
• pnpm tidy
• pnpm build