feat: scope workspace routes by organization slug

.trellis/spec/backend/authentication.md

@@ -23,8 +23,18 @@ This document covers backend authentication integration using better-auth, inclu
   - `membership: Membership | null`
   - `permissions: Permission[]`
 - `POST /api/auth/organization` request payload: `{ organizationId: string }`.
+- `POST /api/auth/organization` success response payload includes:
+  - `organization: Organization | null`
+  - `organizations: AccountOrganizationOption[]`
+  - `permissions: Permission[]`
 - `PATCH /api/account/profile` request payload: `{ name: string; avatarUrl: string }`.
 - All responses use `{ success, reason, ...payload }` and `Cache-Control: no-store`.
+- `Organization.slug` is the canonical tenant segment for authenticated workspace URLs.
+  Organization create/update and setup slug generation must reject or rewrite reserved
+  workspace segments from `modules/shared/lib/workspace-routing.ts` so `/app/settings` and
+  similar product routes cannot be interpreted as tenants.
+- Switching organizations should return the selected organization and available organization
+  options so the client can redirect to the same workspace section under the new slug.
 
 #### 4. Validation & Error Matrix
 - Missing/expired session -> `success: false`, `401`, `未登录或会话已过期`.