Split platform-admin from org-owner, hide Trips from non-founding orgs

SAAS_PLAN.md B7. "admin" meant two different things before this: platform
operator (SAAS_PLAN.md's own framing) and, by accident of how
app/settings/layout.tsx was gated, the only role that could ever reach an
org's own billing/members/node-ownership settings. A paying customer who is
their own org's owner couldn't reach their own Settings page - the gate
checked isAdmin, which only platform admins ever have.

settings/layout.tsx now admits org_role === "owner" as well as platform
admins (isAdmin stays valid too, for support access to any org's
settings). Nav.tsx shows the Settings link on the same condition, and moves
Admin (the platform-operator screens: feature flags, users, audit,
correlation debug) out of the customer-facing link group entirely - it was
already gated server-side, this is just the nav no longer implying it's
part of the product.

Trips - an internal utility feature riding along on this stack, not a
tenant-scoped product surface (see [[trips-feature-intentional]]) - drops
out of the customer-facing viewer link group and only shows for the
founding org (new lib/tenancy.ts mirrors app/internal/tenancy.py's
FOUNDING_ORG_ID) or a platform admin, matching the mutation-route gating
routers/trips.py already got in the backend tenancy commit. Reads stay
open to any signed-in user, same as before - trips' own visibility model
(public/private per trip) predates and is unrelated to org tenancy, and
restricting it further wasn't asked for.

Also closes two DEFERRED.md items now that they have somewhere to write to:
app/settings/organization's "Save changes" button now actually calls
c2api.getOrg()/updateOrg() (routers/org.py, shipped in the backend tenancy
commit) instead of being permanently disabled. app/settings/nodes gained an
EnrollmentTokensPanel (mint/list/revoke against the same commit's
/org/enrollment-tokens routes) - without this, B2b's whole point (a
customer enrolls their own node with their own token instead of an
admin-issued key) had no way to actually be used outside a raw API call.

Left alone, and written up as new DEFERRED.md entries instead of guessed
at: node/system *write* routes (approve, create, delete) stay
platform-admin-only rather than being loosened to org owner/operator - a
real gap per SAAS_PLAN.md 2.4, but a separate authorization design that the
plan's 12-item build order doesn't enumerate. And settings/members +
settings/nodes' ownership table both still call GET /admin/users
(platform-admin-only) - a pure org owner who reaches the page via this
commit's gate will get 403s from it. Today's only real user is also a
platform admin, so this is invisible until a second, non-admin org owner
exists.

Typecheck: clean (tsc --noEmit via the WSL-native ~/drb-frontend copy).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

drb-frontend/app/settings/organization/page.tsx

@@ -3,6 +3,7 @@
 import { useEffect, useState } from "react";
 import Link from "next/link";
 import { c2api } from "@/lib/c2api";
+import { useAuth } from "@/components/AuthProvider";
 import { useNodes } from "@/lib/useNodes";
 import { getCurrentSubscription, getPlan, type Subscription } from "@/lib/billing";
 import { Card, CardHeader } from "@/components/ui/Card";
@@ -21,15 +22,40 @@ function StatTile({ label, value }: { label: string; value: string | number }) {
 
 export default function OrganizationSettingsPage() {
   const { nodes } = useNodes();
+  const { isOrgOwner, isAdmin } = useAuth();
   const [memberCount, setMemberCount] = useState<number | null>(null);
   const [sub, setSub] = useState<Subscription | null>(null);
-  const [orgName, setOrgName] = useState("My Organization");
+  const [orgName, setOrgName] = useState("");
+  const [savedName, setSavedName] = useState("");
+  const [orgLoading, setOrgLoading] = useState(true);
+  const [saving, setSaving] = useState(false);
+  const [saveError, setSaveError] = useState<string | null>(null);
+
+  const canEdit = isOrgOwner || isAdmin;
 
   useEffect(() => {
     c2api.listUsers().then((u) => setMemberCount(u.length)).catch(() => setMemberCount(null));
     getCurrentSubscription().then(setSub);
+    c2api.getOrg()
+      .then((org) => { setOrgName(org.name); setSavedName(org.name); })
+      .catch(() => {})
+      .finally(() => setOrgLoading(false));
   }, []);
 
+  async function handleSave() {
+    setSaving(true);
+    setSaveError(null);
+    try {
+      const res = await c2api.updateOrg(orgName.trim());
+      setSavedName(res.name);
+      setOrgName(res.name);
+    } catch (err) {
+      setSaveError(err instanceof Error ? err.message : "Could not save.");
+    } finally {
+      setSaving(false);
+    }
+  }
+
   const plan = sub ? getPlan(sub.planId) : null;
 
   return (
@@ -44,17 +70,21 @@ export default function OrganizationSettingsPage() {
             <label className="text-xs text-gray-400 block mb-1">Organization name</label>
             <input
               value={orgName}
+              disabled={orgLoading || !canEdit}
               onChange={(e) => setOrgName(e.target.value)}
-              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500"
+              className="w-full bg-gray-800 border border-gray-700 rounded-lg px-3 py-2 text-white text-sm focus:outline-none focus:border-indigo-500 disabled:opacity-50"
             />
           </div>
+          {saveError && <p className="text-red-400 text-xs">{saveError}</p>}
           <div className="flex items-center gap-3">
-            <Button size="sm" disabled title="Organization profile isn't persisted server-side yet">
-              Save changes
+            <Button
+              size="sm"
+              disabled={orgLoading || !canEdit || saving || !orgName.trim() || orgName.trim() === savedName}
+              onClick={handleSave}
+              title={!canEdit ? "Only the organization owner can change this" : undefined}
+            >
+              {saving ? "Saving…" : "Save changes"}
             </Button>
-            <span className="text-xs text-gray-600 font-mono">
-              Preview only — no backend endpoint stores this yet.
-            </span>
           </div>
         </div>
       </Card>