Org-slug console URLs across cloud, self-host, and cloudflare hosts

Console routes now live under an optional {-$orgSlug} segment
(executor.sh/<org-slug>/policies). One shared route contract serves every
host: org-scoped hosts canonicalize bare URLs onto the active organization's
slug via a shared OrgSlugGate; local/desktop never set the param and stay
bare.

- packages/core/api: org-slug vocabulary (grammar, RESERVED_ORG_SLUGS,
  slugify + unique generation), AccountOrganization gains slug
- packages/react: consoleRoutes() nests the contract under /{-$orgSlug}
  (orgScoped option for app routes inside the scope), shell links/nav are
  scope-relative, OrgSlugGate canonicalizes (session-moved guard prevents
  switch-back races that invalidate single-use WorkOS session refreshes)
- per-app tsr.routes.ts is the single route-tree definition consumed by both
  vite configs and the new routes:gen scripts (programmatic generator)
- cloud: organizations.slug column (unique) + migration + backfill script;
  slugs minted at create/accept and lazily on resolution; org switcher and
  create-org land on the new org's slug URL; foreign slugs switch the session
  when the caller is a member; onboarding routes stay bare
- self-host: seed adopts the existing single org on slug change instead of
  forking the instance; EXECUTOR_ORG_SLUG validated against the grammar;
  /join/$code stays bare
- cloudflare: SELF_HOSTED_ORG_SLUG env (validated) exposed through the
  account provider

Author: RhysSullivan

apps/cloud/drizzle/0002_remarkable_kitty_pryde.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "organizations" ADD COLUMN "slug" text;--> statement-breakpoint
+CREATE UNIQUE INDEX "organizations_slug_unique" ON "organizations" USING btree ("slug");