fix(security): prevent cross-org KV data leak for multi-org users

[0xcucumbersalad]

Summary

• Remove legacy unscoped /api/kv/:key routes — these lacked resolveOrgFromPath middleware, so org context was resolved via the MCP OAuth fallback path which uses .executeTakeFirst() without ORDER BY. For multi-org users without an x-org-id header, PostgreSQL could return any membership row, causing reads/writes to land in the wrong org's KV namespace. The org-scoped version at /api/:org/kv/:key (mounted in org-scoped.ts with proper middleware) already exists and is unaffected.
• Fix MCP OAuth org resolution fallback — when no x-org-id/x-org-slug header is provided, the fallback now only resolves an org when the user has exactly one membership. Multi-org users without a hint get organization: undefined (resulting in a 400 "Organization required" from any org-scoped endpoint) instead of a non-deterministic pick.

Files changed

File	Change
apps/mesh/src/api/app.ts	Remove legacy /api/kv/:key mount and unused import
apps/mesh/src/core/context-factory.ts	Replace bare .executeTakeFirst() with limit(2).execute() — return the row only when exactly 1 membership exists

Test plan

• bun run check — passes (no type errors)
• bun run fmt — passes
• bun run lint — passes (0 errors)
• bun test apps/mesh/src/core/ — 57 pass, 4 fail (pre-existing integration test failures on main due to no local PostgreSQL)
• Verify GET /api/kv/:key returns 404 (route removed)
• Verify GET /api/:org/kv/:key works correctly with resolveOrgFromPath
• Verify multi-org MCP OAuth user without x-org-id header gets organization: undefined → 400 on org-scoped endpoints

🤖 Generated with Claude Code

---

Summary by cubic

Prevents cross‑org KV access for multi‑org users by removing the unscoped /api/kv/:key and hardening MCP OAuth org resolution. KV is now org‑scoped only; multi‑org requests without an org hint return 400, and removed users no longer get SSO sessions.

• Bug Fixes

  • In MCP OAuth fallback, only resolve an org when the user has exactly one membership; otherwise leave org undefined.
  • Re‑verify org membership in SSO /callback before creating a session; redirect with sso_error=not_a_member if not a member.

• Migration

  • Replace /api/kv/:key with /api/:org/kv/:key.
  • For multi‑org users, include x-org-id or x-org-slug; otherwise org‑scoped endpoints return 400.

^{Written for commit be14453. Summary will update on new commits.}