Add organizations, teams, and RBAC

[jusso-dev]

Problem

Single-scope API keys are enough for early development, but teams need isolated organizations, roles, and permission boundaries.

Scope

• Add organization and team data model.
• Add roles: owner, admin, editor, responder, viewer.
• Add permission checks to monitor, incident, status page, notification, and settings APIs.
• Add invitation flow or bootstrap-only team membership for v1.
• Plan migration from existing single-tenant data into a default organization.

Acceptance criteria

• Existing installs migrate into a default organization without data loss.
• Role permissions are enforced consistently in API handlers.
• API keys can be scoped to an organization and role.
• Tests cover allowed and denied access for each role.
• OpenAPI marks endpoints that require elevated permission.

Notes

This issue is part of the GoUpTime product roadmap.