Discover the bearer API key's own organization and bounded projects

A tenant-bound bootstrap read for an organization-bound credential. The route derives the organization exclusively from the bearer principal and rejects organization_id rather than accepting an arbitrary tenant selector. It returns only organization id/name and project id/name/environment in stable created_at,id order, with an exact count and explicit page metadata. It works for an empty-agent starter workspace and never reads users, credentials, provider/operator data, or secrets; it makes no provider call and performs no write, repair, or lazy creation.