fix(org): allow string orgId in deleteTeamMember to fix CI build

[JOY (JOY)]

What kind of change does this PR introduce?

Bug fix & CI/CD stability

Why was this change needed?

Fixes a TypeScript type mismatch error in OrganizationService.deleteTeamMember where DosOrgSyncWebhookController passed a string orgId while the method originally strictly expected an Organization object.

Other information:

• Unblocks the GitHub Actions Build and Build & Publish Crove Containers workflows.

Checklist:

• I have read the CONTRIBUTING guide.
• I have signed the Contributor License Agreement (CLA).
• I checked that there were no similar issues or PRs already open for this.
• This PR fixes just ONE issue

---

Note

Medium Risk
The new string overload skips in-service role checks for webhook-driven removals; callers must be trusted, while the user-facing delete path is unchanged.

Overview
OrganizationService.deleteTeamMember now accepts either an Organization or an org id string, fixing the TypeScript mismatch when DosOrgSyncWebhookController removes members with targetOrg.id.

When the first argument is a string, the service delegates straight to the repository (no membership/role-level checks). The existing settings flow still passes a full Organization and keeps the same permission checks, with optional chaining on users?.[0]?.role so role reads don’t blow up if users is missing.

^{Reviewed by Cursor Bugbot for commit 241f7cb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_799da80d-6af1-49a2-a253-0978fa7ff666)

[gemini-code-assist]

Code Review

This pull request updates the deleteTeamMember method in OrganizationService to accept either an Organization object or a string representing the organization ID, while also adding optional chaining to user role checks. The review highlights a significant security risk with this change, as overloading the method to accept a string allows authorization and role checks to be bypassed. It is recommended to keep deleteTeamMember strictly typed to Organization and introduce a separate, explicitly named method for system-level deletions.

[gemini-code-assist]

Overloading deleteTeamMember to accept either an Organization object or a string orgId introduces a significant security risk (authorization bypass). When a string is passed, all permission and role checks are silently bypassed. If a developer in a user-facing controller accidentally passes a string orgId instead of the full Organization object, any user could delete team members without authorization.

To prevent this, keep deleteTeamMember strictly typed to Organization to enforce permission checks, and expose a separate, explicitly named method (e.g., deleteTeamMemberByOrgId) for system/webhook actions that are allowed to bypass these checks.

Suggested change

	async deleteTeamMember(org: Organization | string, userId: string) {
	if (typeof org === 'string') {
	return this._organizationRepository.deleteTeamMember(org, userId);
	}
	async deleteTeamMemberByOrgId(orgId: string, userId: string) {
	return this._organizationRepository.deleteTeamMember(orgId, userId);
	}
	async deleteTeamMember(org: Organization, userId: string) {