Get Workos Portal Link

Self-service WorkOS Admin Portal link for the org's owner or admin.

The intent selects which Admin Portal section the customer lands on (sso, dsync, domain_verification, audit_logs). The WorkOS portal does not expose cross-intent navigation, so each section needs a separately generated link.

On first call for an unlinked org, this creates a WorkOS Organization named after the local org and links it. Subsequent calls just return fresh portal links — same shape as POST /api/stripe/portal-session. Links expire in ~5 minutes; the frontend redirects immediately.