Add organization user by ID

Create or update an OrgUser membership for an existing User. Idempotent: if the user is already a member, their role is updated to the supplied value. Used by automation that holds a userId directly. Requires org admin. Accepts users with email_confirmed=false (e.g. invited but not yet accepted).