Refactor/organization details

[s0582346]

Rebuilds organization details page (/admin/ngo-details) into a full admin surface for a Verein.

What changed

Frontend — page rewritten as section cards (general · legal · contact · users) with a sticky header whose
save/discard actions appear only once something is dirty. Logo picking only stages the file; the upload happens on
save. Users section lists members with position, email and a status pill, plus an Add user dialog.

Logo — OrganizationLogoService stores the image in S3, keeping only logoKey/logoContentType on the
organization (@JsonIgnore). Clients get a derived hasLogo and fetch bytes separately.

Invitations — POST /organization/my/members provisions a Keycloak account, assigns the member role and has
Keycloak email a password-setup link. INVITED if the mail went out, INVITATION_FAILED if not. The account exists either way, which is why that's a status and not an error. An existing Keycloak user for that email
is linked rather than failing.

Member status — NO_ACCESS → INVITED/INVITATION_FAILED → ACTIVE. Keycloak never reports a completed
invitation, so the flip to ACTIVE happens on the first request carrying the person's token.

Organization.type — nested Organization.TYPE → top-level OrganizationType with the legal forms the UI offers.
The column moves from an ordinal smallint check (type between 0 and 1) to the enum name, which unblocks new legal
forms and stops tying stored data to enum declaration order.

Local dev — mailpit in docker-compose (SMTP 1025, UI http://localhost:8025) catches invitation mails;
quarkus-realm.json points SMTP at host.docker.internal:1025 and gains the org-admin role for invited people.