fix(org): auto-enroll idempotency, signup enrollment, and pending invite gate (#729)

* fix(org): auto-enroll idempotency, pending invites, and tenant enrollment

- Map Postgres unique violations to 409 CONFLICT instead of 500
- Link email-only roster rows before signup policy gates (preserve role)
- Return pendingInvite when an active org invite exists; surface modal globally
- Enroll at signup via create-profile hook when cio-org-id header is present
- Gate client auto-enroll on session orgRoles and pending invite check
- Throw 409 when org email row is linked to a different profile (Greptile)
- Enforce free-plan student cap via assertStudentCapacityOrThrow on new enrolls
- Hide student-only orgs from admin org switcher; redirect students off /org/[slug]
- Route tutor/admin pending-invite accepts on tenant sites to app host

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

* perf(dashboard): parallelize account and pending invite fetch on tenant bootstrap

Start GET /account and GET /invite/organization/pending together when a
logged-in user visits a tenant site without session membership. Auto-enroll
still runs sequentially after both complete when no invite is found, then
refetches /account if enrollment succeeds.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

* fix: address PR review — restore AppModeWatcher and drop signup ctx enrollment

Better Auth database hooks do not receive frontend cio-org-id headers in ctx,
so enrollFromSignupOrgContext could never work. Revert to client-side auto-enroll
fallback and restore main's AppModeWatcher in the root layout.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

* refactor(org): rename auto-enroll-student endpoint to auto-join

POST /organization/auto-join replaces /auto-enroll-student to clarify this
joins org membership, not course enrollment. Renamed service to autoJoinOrg.

Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

---------

Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Rotimi Best <rotimi-best@users.noreply.github.com>

apps/api/src/routes/organization/organization.ts

@@ -50,7 +50,7 @@ import { Hono } from '@api/utils/hono';
 import { ROLE } from '@cio/utils/constants';
 import { TOrganization } from '@db/types';
 import { assetsRouter } from '@api/routes/organization/assets';
-import { autoEnrollStudent } from '@api/services/organization/auto-enroll';
+import { autoJoinOrg } from '@api/services/organization/auto-join';
 import { organizationAiTutorRouter } from '@api/routes/organization/ai-tutor';
 import { authMiddleware } from '@api/middlewares/auth';
 import { authOrApiKeyMiddleware } from '@api/middlewares/auth-or-api-key';
@@ -125,13 +125,13 @@ export const organizationRouter = new Hono()
    * Requires authentication
    */
   /**
-   * POST /organization/auto-enroll-student
-   * Idempotently enrolls the authenticated user as a STUDENT in the org
-   * identified by the `cio-org-id` header. Called by the dashboard's
-   * `setupApp` after a user authenticates on a tenant site they aren't a
-   * member of yet. Respects `disableSignup` and `inviteOnly` policies.
+   * POST /organization/auto-join
+   * Idempotently joins the authenticated user to the org identified by the
+   * `cio-org-id` header. Called by the dashboard's `setupApp` after a user
+   * authenticates on a tenant site they aren't a member of yet. Respects
+   * `disableSignup` and `inviteOnly` policies.
    */
-  .post('/auto-enroll-student', authMiddleware, async (c) => {
+  .post('/auto-join', authMiddleware, async (c) => {
     try {
       const user = c.get('user')!;
       const orgId = c.req.header('cio-org-id');
@@ -140,10 +140,10 @@ export const organizationRouter = new Hono()
         return c.json({ success: false, error: 'Organization ID is required', code: 'ORG_ID_REQUIRED' }, 400);
       }
 
-      const result = await autoEnrollStudent(user.id, orgId);
+      const result = await autoJoinOrg(user.id, orgId);
       return c.json({ success: true, data: result }, 200);
     } catch (error) {
-      return handleError(c, error, 'Failed to auto-enroll student');
+      return handleError(c, error, 'Failed to auto-join organization');
     }
   })
   .get('/team', authMiddleware, orgTeamMemberMiddleware, async (c) => {