feat: add organization tenant model

hub/test/integration/helpers.ts

@@ -19,6 +19,7 @@ import type { FeishuRuntime } from "../../src/feishu/client.js";
 import type { ModelFactory } from "../../src/agent/runner.js";
 
 export const TEST_DATABASE_URL = "postgresql://paradigm:paradigm@127.0.0.1:5432/cph_hub_test";
+export const DEFAULT_ORG_ID = "org_test_default";
 
 export const prisma = new PrismaClient({
   datasources: { db: { url: TEST_DATABASE_URL } },
@@ -35,6 +36,7 @@ export async function resetDb(): Promise<void> {
     "PermissionGrant",
     "RoleTriggerGrant",
     "ExternalPrincipalMembership",
+    "ExternalDirectoryConnection",
     "TeamExternalBinding",
     "TeamMembership",
     "Team",
@@ -42,12 +44,30 @@ export async function resetDb(): Promise<void> {
     "AgentRun",
     "AgentSession",
     "ProjectGroupBinding",
+    "OrganizationMembership",
     "PlatformRoleAssignment",
     "User",
     "Project",
+    "Organization",
   ];
   // Truncate with CASCADE to wipe dependent rows in one shot.
   await prisma.$executeRawUnsafe(`TRUNCATE TABLE ${tables.map((t) => `"${t}"`).join(", ")} RESTART IDENTITY CASCADE`);
+  await seedTestOrganization();
+}
+
+export async function seedTestOrganization(
+  id: string = DEFAULT_ORG_ID,
+  slug: string = "test-default",
+): Promise<void> {
+  await prisma.organization.upsert({
+    where: { id },
+    update: {},
+    create: {
+      id,
+      slug,
+      name: "Test Default Organization",
+    },
+  });
 }
 
 /** A logger that discards everything (tests don't need fastify's pino). */
@@ -340,6 +360,7 @@ export async function seedProject(
   await prisma.project.create({
     data: {
       id: projectId,
+      organizationId: DEFAULT_ORG_ID,
       name: `Test ${projectId}`,
       workspaceDir: `/tmp/test-${projectId}`,
     },
@@ -350,6 +371,7 @@ export async function seedProject(
       feishuOpenId: principal,
       displayName: "Test User",
       platformRoles: { create: { role: "TEACHER" } },
+      organizationMemberships: { create: { organizationId: DEFAULT_ORG_ID, role: "MEMBER" } },
       permissionGrants: {
         create: {
           resourceType: "PROJECT",