Organizations: align ListOrganizations visibility for cluster-admin org switching (spec)

[rowan-stein]

User request

Adjust Organizations service behavior so Console can support cluster-admin org switching as specified for Activity lists.

Source spec: https://github.com/agynio/architecture/blob/main/changes/2026-04-24-activity-server-side-lists.md

Specification (architecture/product)

From:

• changes/2026-04-24-activity-server-side-lists.md
• product/console/console.md (org switching notes)

Required behavior:

• Cluster admins can context-switch across all orgs via Organizations.ListOrganizations.
• Non-admin users must not see all orgs; they should use ListMyMemberships (or an equivalent filtered list) for org selection.

Work items

• Update ListOrganizations to match spec:
  • If caller is a cluster admin: return all orgs (paginated).
  • Otherwise: return permission denied (or return only accessible orgs — decide consistent behavior, but must not leak all orgs).
• Confirm ListAccessibleOrganizations and ListMyMemberships behavior stays correct and consistent.
• Add/extend tests to cover cluster-admin vs non-admin visibility.

Acceptance

• Cluster admin can list all organizations.
• Non-admin callers cannot retrieve the full org list via ListOrganizations.