[2c] Org isolation enforcement

[andrmaz]

What to build

All read and write paths in the API and MCP layer are scoped by the authenticated user's Organization at the middleware/query layer. Cross-organization data access is blocked by default. Org-scoping is enforced for every Prisma query and is not an opt-in.

Acceptance criteria

• A middleware/helper enforces org-scoped filtering on all DB queries.
• Attempting to read another org's data via API returns 403/404.
• MCP calls are also org-scoped — no cross-org leakage through the MCP path.
• Integration tests verify isolation for both API and MCP paths.

Blocked by

• [1c] MCP entrypoint + identity resolution #7 [1c] MCP entrypoint + identity resolution
• [2b] User and department management #5 [2b] User and department management