Add organization membership and role management in admin interface (#18483)

* Add organization membership and role management in admin interface

- Add view functions for adding, updating, and deleting organization roles
- Add routes for the new role management endpoints
- Update organization detail template to show interactive role management UI
- Add dropdown for role changes with explicit save button
- Add confirmation modal for removing members
- Add comprehensive tests for all new functionality
- Consolidate all organization-related code into existing files

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

* feat(admin): use form for organization role selection

- Create OrganizationRoleForm using wtforms.SelectField with enum
- Update organization_detail view to provide role_forms dictionary
- Pass OrganizationRoleType enum to template context
- Update template to use role_forms instead of hardcoded options
- Update tests to verify new context variables

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

* refactor(admin): use forms for all organization role fields

- Add AddOrganizationRoleForm with username and role_name fields
- Update organization_detail to provide add_role_form
- Remove OrganizationRoleType from template context
- Update template to use add_role_form for member addition
- Update tests to check for add_role_form instead of enum

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

* Update tests/unit/admin/views/test_organizations.py

Co-authored-by: Mike Fiedler <[email protected]>

* refactor(admin): use organization.roles relationship

- Replace separate query with organization.roles relationship
- Sort roles by username using Python instead of SQL

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

* fix(admin): add CSRF protection to organization role views

- Add require_csrf=True to add_organization_role view
- Add require_csrf=True to update_organization_role view
- Add require_csrf=True to delete_organization_role view

This ensures consistency with other POST endpoints in the admin
interface and prevents CSRF attacks.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

* feat(admin): add AdminRoleUpdate permission

- Add new AdminRoleUpdate permission to _permissions.py
- Grant AdminRoleUpdate to admins, support, and moderators groups
- Update organization role update view to use AdminRoleUpdate permission
- Update template to check AdminRoleUpdate permission for role updates

This provides proper granularity for role management permissions,
distinguishing between add, update, and delete operations.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

* refactor: use real service fixtures in organization tests

Remove stub services from organization tests and use the real service
fixtures provided by db_request. This makes the tests more realistic
and less brittle.

- Remove organization_service and billing_service stubs
- Use db_request's built-in service fixtures
- Update tests that need to mock specific methods to use monkeypatch
- Remove unused IOrganizationService import

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

* fix: update test_config to include AdminRoleUpdate permission

Add AdminRoleUpdate permission to test_root_factory_access_control_list
to match the permissions added in config.py

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

---------

Co-authored-by: Claude <[email protected]>
Co-authored-by: Mike Fiedler <[email protected]>

Author: 3 people

tests/unit/admin/test_routes.py

@@ -29,6 +29,21 @@ def test_includeme():
             "/admin/organizations/{organization_id}/rename/",
             domain=warehouse,
         ),
+        pretend.call(
+            "admin.organization.add_role",
+            "/admin/organizations/{organization_id}/add_role/",
+            domain=warehouse,
+        ),
+        pretend.call(
+            "admin.organization.update_role",
+            "/admin/organizations/{organization_id}/update_role/{role_id}/",
+            domain=warehouse,
+        ),
+        pretend.call(
+            "admin.organization.delete_role",
+            "/admin/organizations/{organization_id}/delete_role/{role_id}/",
+            domain=warehouse,
+        ),
         pretend.call(
             "admin.organization_application.list",
             "/admin/organization_applications/",