feat(site): scope chat model settings to organizations - #27960

Part of CODAGT-709.

Moves the AI model settings under /ai/settings/organizations/:organization/models, with an organisation switcher and redirects from the legacy paths. Provider state is rebuilt from the server's redacted descriptors instead of deployment values, the agents sidebar fetches models once per organisation the user belongs to (failures downgrade to a partial error rather than blanking the page), and the page-level RequirePermission gate is gone: the server's RBAC filter is the source of truth, and the UI gate is advisory. The fan-out exists because the model catalog is now per-organisation and there is deliberately no cross-organisation union endpoint; requests run in parallel and most users are in one or two organisations, so this is fine for now, but a union endpoint is the natural follow-up if deployments with many organisations per user find it costly.

One shared-component change to flag: OrganizationAutocomplete now sorts deterministically (active organisation first, then alphabetical), and gains ariaLabel/triggerClassName props plus a keyboard-navigation workaround for a cmdk issue. The sort change is visible in the template and user creation forms too, since they share the component.

Must merge together with the API PR below it, which deletes the routes this branch stops calling.