Resolve an org-scoped slug to a product or source

Product-first: returns { kind: "product", product } when a product owns the slug, else { kind: "source", source } for a source, else 404. One round trip for the bare /[org]/[slug] web route (#1190).