fix(controlplane): bind Flight sessions to connection SNI org, not a username map

[fuziontech]

Follow-up to #651, addressing the review blocker from @EDsCODE.

Problem

#651 made Flight auth resolve the org from SNI correctly, but the result was stashed in a process-global map keyed by bare username:

// during auth:
v.orgProvider.userOrg[username] = orgID
// later, at session create:
orgID := p.userOrg[username]

Usernames are only unique within an org, so two tenants can both have alice:

1. alice@acme.<suffix> authenticates → userOrg["alice"] = org-acme
2. another alice@beta.<suffix> authenticates → overwrites → userOrg["alice"] = org-beta
3. connection 1 creates its Flight session and is routed to org-beta's worker stack.

This reintroduced the exact username-collision class the SNI-only identity change was meant to eliminate — the SNI-scoped principal was collapsed back to a username at the auth→session handoff.

Fix

Derive the session's org from the connection's managed hostname (SNI) — the same immutable per-connection identity auth uses — re-resolved at session-create time, and delete the username map entirely:

• orgRoutedSessionProvider drops userOrg and gains an injected resolveOrg(ctx) (orgID, ok). CreateSession resolves the org from the request context's SNI and fails closed if it doesn't resolve.
• Production wires resolveOrg to ControlPlane.flightOrgFromContext (extract SNI from the gRPC peer → resolveFlightOrgFromSNI). The Flight validator now only authenticates (ValidateOrgUser against the SNI-resolved org) and stores no routing state. The Postgres-side resolution is untouched.
• The ctx reaching CreateSession is a timeout-child of the gRPC request ctx, so peer.FromContext still yields the TLS ServerName.

There is now no shared mutable username→org state anywhere in the Flight path; routing identity is a pure function of the connection's hostname.

Tests

• TestOrgRoutedSessionProviderRoutesByContextSNINotUsername: two connections sharing username alice from different org contexts each route to their own org (StackForOrg(org-a) then (org-b)), proving the collision is gone.
• TestOrgRoutedSessionProviderFailsClosedWhenSNIUnresolved: no session created when the SNI doesn't resolve.
• Updated the validator unit tests (no more userOrg assertion); the durable-reconnect path already carried OrgID correctly and is unchanged.

Builds clean on both default and -tags kubernetes; controlplane suite green on both.

🤖 Generated with Claude Code