The organization this request is bound to, and the caller's own identity and rights in it

For a client holding an organization-bound token, which GET /organizations cannot disambiguate for someone in several. Returns the bound organization (id, name, slug, plan, logo, product) and: features (crm, timeTracking, resourceMgmt, each true when the plan or an admin override grants it, as the feature gates decide); scheduleAccess (sprints, scheduleRisk, each { on, trialDays }: on as the feature gates decide; trialDays is the length of the Pro trial a locked control in Onplana Schedule may mention, null when none is offered); grants (timesheetsRead, timesheetsWrite: whether this token itself holds TIMESHEETS_READ and TIMESHEETS_WRITE); timesheetApproval (whether timesheet approval is on); currentUser { id, name, email }; canViewAllProjects (org.project.view.all), canCreateProjects (org.project.create), canManageTags (org.tag.manage) and canManagePortfolios (org.portfolio.manage), resolved from the organization's permission matrix and the caller's live role, as the web app resolves them; portfoliosOnPlan (whether the plan lets GET /api/portfolios answer: the portfolios feature, or a read-only downgrade grace window covering it); approverOf { access, gates, changes, timesheets }: the approval rails the caller decides on (project lead or org Owner/Admin/Manager, designated gate reviewer, CCB member, timesheet approver).