fix(api,user-ui,sdk): skip repeat org switch consent

[markwylde]

Summary

• restore SDK org switching to the authorize-code path by default
• auto-finalize eligible non-ZK authorize requests when the existing session already covers the same client and scopes
• keep the session organization mutation endpoint same-origin/CSRF-protected and update the org switching spec

Verification

• Not run

Notes

• This avoids the Atlas consent screen without relying on cross-site session mutation from the Atlas SPA.