feat: scope workspace routes by organization slug

app/api/organizations/[id]/route.ts

@@ -6,6 +6,7 @@ import { requirePermission } from "@/modules/core/server/auth";
 import { getDatabase } from "@/modules/core/server/db";
 import { organizations } from "@/modules/core/server/schema";
 import type { OrganizationStatus } from "@/modules/core/types";
+import { RESERVED_WORKSPACE_SLUGS } from "@/modules/shared/lib/workspace-routing";
 
 type RouteContext = {
   params: Promise<{
@@ -38,7 +39,7 @@ function readStatus(value: unknown): OrganizationStatus | null {
 }
 
 function isValidSlug(value: string): boolean {
-  return /^[a-z0-9][a-z0-9-]{1,47}$/.test(value) && !value.endsWith("-");
+  return /^[a-z0-9][a-z0-9-]{1,47}$/.test(value) && !value.endsWith("-") && !RESERVED_WORKSPACE_SLUGS.has(value);
 }
 
 export async function PATCH(request: Request, context: RouteContext): Promise<Response> {
@@ -74,7 +75,7 @@ export async function PATCH(request: Request, context: RouteContext): Promise<Re
     return jsonFailure("机构标识不能为空");
   }
   if (slug && !isValidSlug(slug)) {
-    return jsonFailure("机构标识仅支持小写字母、数字和连字符，长度 2-48 位，且不能以连字符结尾");
+    return jsonFailure("机构标识仅支持小写字母、数字和连字符，长度 2-48 位，不能以连字符结尾，且不能使用系统路径保留字");
   }
   const registrationEnabled = "registrationEnabled" in body ? readBoolean(body, "registrationEnabled") : null;
   const oidcEnabled = "oidcEnabled" in body ? readBoolean(body, "oidcEnabled") : null;