Create the caller's organization

Creates the organization for a signed-in user who has none, sets its external id to the derived tenant slug, adds the caller as an active `admin`, and provisions the tenant. Idempotent: a caller who already belongs to an organization gets it back with `created: false` rather than a second one. A caller who has been invited to an organization is refused instead, so they can accept that invitation rather than being given a second organization of their own. The session must be re-issued afterwards — token claims are set at authentication, so the current token still carries no tenant.