Who the caller may seat in a chat belonging to this organization.

Backs the new-chat people-picker's filter. That filter is a COURTESY, not a boundary: ChatService.create_chat refuses a non-member regardless, and it has to, because a picker is not an authorization gate. Without the filter the ordinary flow is to pick a colleague, press Create, and get a 403 naming a UUID.

The roster comes from org_admitted_identities, one bounded query whose row count is the ORGANIZATION's size. It is deliberately not a scan of every active identity with a membership check per row, which is what shipped first and is O(identities) queries on an endpoint a picker opens.

403 for a non-member caller. Membership of an organization is not public: the roster names who works there, and handing it to anyone who can guess a tenant id would make this endpoint a directory.