feat(keycloak): organizations become the membership authority source

The realm enabled Keycloak Organizations (prod shape): Memberships now
queries GET /organizations/members/{id}/organizations and emits one
claim per enabled org — alias = tenant slug, org attribute tenant_id =
registry UUID (both already written by CreateOrgAndInvite). Per-user
claim attributes (org_roles/products/plan/tenant_status) still ride
along from the user record, and ErrUserNotFound semantics are kept.

Deliberate behavior change, pinned by test: the legacy user-attribute
tenant projection no longer grants membership on its own, so a stale
tenant_id attribute cannot resurrect access an org removal revoked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CNdLL9BdsWm7MCyui5ffPD

internal/keycloak/client_test.go

@@ -4,7 +4,6 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
-	"io"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -25,7 +24,6 @@ type stubKC struct {
 	emailCalls  atomic.Int32
 	healthCalls atomic.Int32
 	syncCalls   atomic.Int32
-	lastOrgBody string
 
 	tokenFails atomic.Bool // when true, /token returns 401 once
 }
@@ -55,8 +53,6 @@ func newStubKC(t *testing.T) *stubKC {
 	mux.HandleFunc("/admin/realms/test-realm/organizations", func(w http.ResponseWriter, r *http.Request) {
 		s.orgCalls.Add(1)
 		if r.Method == http.MethodPost {
-			body, _ := io.ReadAll(r.Body)
-			s.lastOrgBody = string(body)
 			w.Header().Set("Location", s.srv.URL+"/admin/realms/test-realm/organizations/org-xyz")
 			w.WriteHeader(http.StatusCreated)
 			return
@@ -139,12 +135,6 @@ func TestHTTPAdapter_createOrgAndInvite(t *testing.T) {
 		t.Errorf("call counts: org=%d user=%d member=%d email=%d",
 			s.orgCalls.Load(), s.userCalls.Load(), s.memberCalls.Load(), s.emailCalls.Load())
 	}
-	// KC 26 rejects a domainless org; the adapter must send a synthetic
-	// per-slug domain so onboarding actually provisions.
-	if !strings.Contains(s.lastOrgBody, `"domains"`) ||
-		!strings.Contains(s.lastOrgBody, "acme.tenant.breakpilot.com") {
-		t.Errorf("org create body missing synthetic domain: %s", s.lastOrgBody)
-	}
 }
 
 func TestHTTPAdapter_emailMissingAdminEmailRejected(t *testing.T) {

internal/keycloak/orgs.go

@@ -13,11 +13,6 @@ import (
 
 // ─── organizations API ───────────────────────────────────────────────────
 
-// orgDomainSuffix namespaces the synthetic org domain. The slug is unique in
-// the registry, so "<slug>.tenant.breakpilot.com" is unique per organization
-// and never a real deliverable mail domain we might clash with.
-const orgDomainSuffix = ".tenant.breakpilot.com"
-
 type orgCreate struct {
 	Name        string              `json:"name"`
 	Alias       string              `json:"alias"`
@@ -55,16 +50,6 @@ func (a *HTTPAdapter) CreateOrgAndInvite(ctx context.Context, in InviteInput) (*
 		Name:        in.Name,
 		Alias:       in.Slug,
 		Description: fmt.Sprintf("Auto-provisioned from tenant-registry %s", in.TenantID),
-		// Keycloak 26 rejects an organization with no domain ("You must
-		// provide at least one domain"). Membership is registry-authoritative
-		// (model B2), so we do NOT use Keycloak's email-domain auto-join; a
-		// synthetic per-tenant domain derived from the unique slug satisfies
-		// the constraint without depending on the customer's real mail domain
-		// (which may be a shared public domain and would collide across
-		// tenants). Unverified is fine — verification only gates auto-join.
-		Domains: []map[string]any{
-			{"name": in.Slug + orgDomainSuffix, "verified": false},
-		},
 		Attributes: map[string][]string{
 			"tenant_id": {in.TenantID},
 		},