List organizations accessible to the current token.

Returns the set of organizations the calling token may scope requests to.

For long-lived apiToken callers (single-org by construction), the list always has one element — the org the token was generated under.

For ephemeral mcpSession callers (OAuth-minted from the hosted MCP), the list contains every org the authenticated Cognito user has a membership in. The agent should call this endpoint to enumerate the user's orgs, then pass the chosen id back as ?organization_id=<uuid> on subsequent org-scoped requests.