[P2][Deferred][SaaS] Organizationをproduction Tenant Cellへserver-side routeする

[Hosi121]

Parent / dependencies

• Parent: [P2][Deferred][Epic][SaaS] Studioをmulti-tenant SaaS実行基盤へ移行する #116
• Durable assignment implementation: [P0][Runtime] Organization→runtime-cell assignmentをPostgreSQLへ永続化する #541（complete）
• Blocked by live staging authority: [P2][Deferred][Infra] staging managed PostgreSQL・Hyperdrive authorityを構築する #431
• Final integration: [P2][Deferred][Canary] same-origin stagingでaccount・billing・collaboration・exportを統合証明する #372

Current state — 2026-08-18

membership-authorized resolver、bounded Tenant Cell lifecycle/cache、generation rotation/drain、capacity、forged/stale/disabled assignment拒否、PostgreSQL durable assignment authorityはmainへ統合済み（#435 / #541）。

残件は#431のstaging authority上で行うlive provisioningと、同じpublic originからのtwo-Organization routing/denial evidenceだけである。

Goal

すべてのauthenticated Organizationをuser-controlled backend情報へ依存せずserver-owned Tenant Cellへrouteし、複数active Organizationを同じpublic originから安全に処理する。

Acceptance criteria

• durable Organization-to-cell assignmentとgeneration lifecycleをPostgreSQLへ接続
• request header/path/project/client stateからcellを選択・forgeできない
• membershipをrouting直前に再検証し、authorized Organizationとruntime tenantを一致させる
• missing/disabled/stale/conflicting assignmentをboundedにfail closed
• stagingでtwo active Organizationsが同じpublic originのAPIを同時利用できる
• newly provisioned Organizationがprocess-wide restartなしにroutableになる
• one Organizationのreadiness/outageから別Organizationの存在・状態が漏れない
• source/editor/export/media/cache/billing usageがtenant-correlatedである
• live happy pathとcross-tenant denialを#372へ記録する
• log/metricへsource/path/credential/raw identity claimを出さない

Non-goals

• trusting IdP tenant claims
• user-controlled runtime URLs
• region-aware global scheduling/autoscaling in the first slice

[Hosi121]

PR #435 merged the request-path vertical slice: membership-authorized principals now resolve through a server-owned bounded cell resolver; two Organizations, generation rotation/drain, capacity, forged/stale/disabled assignment failures, and the shared durable provisioner seam are covered locally. The remaining closure item is the durable assignment authority/repository and its production-shaped provisioning proof; the current assignment source is intentionally injected rather than persisted by this PR.