Pre-release: Harden auth and organization claim API behavior

[wauputr4]

Goal

Make the release-critical auth and organization claim APIs predictable under validation, authorization, duplicate, and conflict cases.

Scope

• Add focused tests for register/login/logout/me failures and session expiry behavior.
• Add focused tests for organization claim create/list/review, including duplicate claim handling and rejected/approved transitions.
• Verify authorization boundaries for org-admin claim review and scoped admin keys.
• Ensure error codes and HTTP statuses are stable for UI consumption.
• Add audit/logging checks where claim review mutates ownership or roles.

Definition of done

• Auth and claim edge cases are covered by automated tests.
• UI can rely on documented status codes and error codes for duplicate/conflict/unauthorized states.
• go test ./... passes.