Add DeleteOrganizationResources

[vitramir]

Step 2 of the organization teardown: the organization's workload records, provisioned volume records, and org-scoped runners.

Removing the records is what makes the running pods and disks orphans, which the Orchestrator's existing reconciliation then stops and deprovisions. No stop-everything path is added for a case reconciliation already covers.

Three decisions worth reviewing:

1. The rows go outright, not removed_at. DeleteWorkload soft-deletes so metering can still sample the row. The organization it is scoped by is going away, and a row holding an organization_id that resolves to nothing is exactly what this change set is fixing.
2. Workloads are deleted by organization, not left to the runner cascade. workloads.runner_id cascades from runners, so deleting the org's runners would take their workloads — but an organization's workloads also run on cluster-scoped runners, which survive the teardown. Relying on the cascade alone would strand those.
3. Workload tuples come off before the rows, batched at OpenFGA's per-Write limit of 100. A step interrupted after the rows are gone would have nothing left to enumerate the tuples from.

DeleteRunner keeps its permission check; both it and the teardown now call the same deleteRunnerRecord helper, so a runner leaves through the same door — OpenZiti identity cleanup and membership-tuple removal included — however it is removed.

New rule on the existing AuthorizationPolicy admitting only the organizations ServiceAccount. Chart bumped to 0.2.0.

Part of organization settings and deletion.