Check whether this instance serves a CLI sign-in

WorkOS picks the organization a device-code sign-in lands on, with no way for the CLI to steer it. This route tells a freshly signed-in CLI whether this instance serves the token's organization and, if not, which of the user's organizations it does serve, so the CLI can switch to one before saving the credential. The token travels in the body because the authentication hook refuses a token for an organization this instance does not serve.