fix(api,user-ui): protect organization administrator role

[markwylde]

Summary

• Enforce organization administrator invariants in the API when removing a member role.
• Add a permission-based check so removing a role that grants darkauth.org:manage cannot leave an organization without any administrator.
• Extend organization role/member payloads with grantsOrgManage metadata for UI enforcement.
• Update the organization detail UI to prevent unsafe removals (role removal and member removal states), and wire role-add/remove state handling consistently.
• Add API test coverage to validate the last administrator role cannot be removed.