List Organization States

Feeds the Organizations list's State filter (a searchable combobox, not a hardcoded 50-state dropdown -- see service.list_distinct_states). Declared BEFORE GET /organizations/{org_id} below: FastAPI/Starlette matches routes in registration order, and {org_id} has no path-level type constraint of its own (only the Python parameter is typed UUID), so a request for /organizations/states would otherwise be captured by the dynamic route and 422 trying to parse "states" as a UUID -- exactly the ordering PR #205's org-name JOIN fix had to get right.