Self Serve Create Org

Create the caller's first org.

Workspace-domain signup (alice@acme.com) can call this with no body — we title-case the domain label into a default name ("Acme") and slug.

Consumer-domain signup (michael@gmail.com) must supply {name, slug} explicitly; calling with no body returns 409 name_required so the console can render its FirstOrgForm prompt instead of inflicting "Gmail" on the user.

Allowed only when the caller has zero existing memberships; subsequent org creation goes through POST /api/admin/orgs.

Idempotency: a Postgres TRANSACTION-scoped advisory lock keyed on user_id serializes concurrent self-serve calls. (We deliberately do NOT use the session-scoped pg_advisory_lock — on a pooled connection a session lock leaks across requests.)