feat: scope workspace routes by organization slug

app/api/organizations/route.ts

@@ -7,6 +7,7 @@ import { getDatabase } from "@/modules/core/server/db";
 import { seedOrganizationRoles } from "@/modules/core/server/permissions";
 import { organizations } from "@/modules/core/server/schema";
 import { getSystemSettings } from "@/modules/core/server/system-settings";
+import { RESERVED_WORKSPACE_SLUGS } from "@/modules/shared/lib/workspace-routing";
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
@@ -18,7 +19,7 @@ function readString(source: Record<string, unknown>, key: string): string {
 }
 
 function isValidSlug(value: string): boolean {
-  return /^[a-z0-9][a-z0-9-]{1,47}$/.test(value) && !value.endsWith("-");
+  return /^[a-z0-9][a-z0-9-]{1,47}$/.test(value) && !value.endsWith("-") && !RESERVED_WORKSPACE_SLUGS.has(value);
 }
 
 export async function GET(): Promise<Response> {
@@ -75,7 +76,7 @@ export async function POST(request: Request): Promise<Response> {
     return jsonFailure("机构标识不能为空");
   }
   if (!isValidSlug(slug)) {
-    return jsonFailure("机构标识仅支持小写字母、数字和连字符，长度 2-48 位，且不能以连字符结尾");
+    return jsonFailure("机构标识仅支持小写字母、数字和连字符，长度 2-48 位，不能以连字符结尾，且不能使用系统路径保留字");
   }
 
   const database = getDatabase();