Split platform-admin from org-owner, hide Trips from non-founding orgs

SAAS_PLAN.md B7. "admin" meant two different things before this: platform
operator (SAAS_PLAN.md's own framing) and, by accident of how
app/settings/layout.tsx was gated, the only role that could ever reach an
org's own billing/members/node-ownership settings. A paying customer who is
their own org's owner couldn't reach their own Settings page - the gate
checked isAdmin, which only platform admins ever have.

settings/layout.tsx now admits org_role === "owner" as well as platform
admins (isAdmin stays valid too, for support access to any org's
settings). Nav.tsx shows the Settings link on the same condition, and moves
Admin (the platform-operator screens: feature flags, users, audit,
correlation debug) out of the customer-facing link group entirely - it was
already gated server-side, this is just the nav no longer implying it's
part of the product.

Trips - an internal utility feature riding along on this stack, not a
tenant-scoped product surface (see [[trips-feature-intentional]]) - drops
out of the customer-facing viewer link group and only shows for the
founding org (new lib/tenancy.ts mirrors app/internal/tenancy.py's
FOUNDING_ORG_ID) or a platform admin, matching the mutation-route gating
routers/trips.py already got in the backend tenancy commit. Reads stay
open to any signed-in user, same as before - trips' own visibility model
(public/private per trip) predates and is unrelated to org tenancy, and
restricting it further wasn't asked for.

Also closes two DEFERRED.md items now that they have somewhere to write to:
app/settings/organization's "Save changes" button now actually calls
c2api.getOrg()/updateOrg() (routers/org.py, shipped in the backend tenancy
commit) instead of being permanently disabled. app/settings/nodes gained an
EnrollmentTokensPanel (mint/list/revoke against the same commit's
/org/enrollment-tokens routes) - without this, B2b's whole point (a
customer enrolls their own node with their own token instead of an
admin-issued key) had no way to actually be used outside a raw API call.

Left alone, and written up as new DEFERRED.md entries instead of guessed
at: node/system *write* routes (approve, create, delete) stay
platform-admin-only rather than being loosened to org owner/operator - a
real gap per SAAS_PLAN.md 2.4, but a separate authorization design that the
plan's 12-item build order doesn't enumerate. And settings/members +
settings/nodes' ownership table both still call GET /admin/users
(platform-admin-only) - a pure org owner who reaches the page via this
commit's gate will get 403s from it. Today's only real user is also a
platform admin, so this is invisible until a second, non-admin org owner
exists.

Typecheck: clean (tsc --noEmit via the WSL-native ~/drb-frontend copy).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

drb-frontend/components/Nav.tsx

@@ -7,6 +7,7 @@ import { useUnconfiguredNodes } from "@/lib/useNodes";
 import { useUnacknowledgedAlerts } from "@/lib/useAlerts";
 import { useAuth } from "@/components/AuthProvider";
 import { useTheme } from "@/components/ThemeProvider";
+import { FOUNDING_ORG_ID } from "@/lib/tenancy";
 
 // Links visible to all authenticated roles (viewer+)
 const viewerLinks = [
@@ -15,9 +16,13 @@ const viewerLinks = [
   { href: "/incidents", label: "Incidents" },
   { href: "/map",       label: "Map" },
   { href: "/alerts",    label: "Alerts" },
-  { href: "/trips",     label: "Trips" },
 ];
 
+// Trips is an internal utility feature, not a tenant-scoped product surface
+// (see [[trips-feature-intentional]] and SAAS_PLAN.md B7) — shown only to
+// the founding org, matching routers/trips.py's own gating.
+const tripsLink = { href: "/trips", label: "Trips" };
+
 // Additional links for operators and admins
 const operatorLinks = [
   { href: "/nodes",   label: "Nodes" },
@@ -25,10 +30,10 @@ const operatorLinks = [
   { href: "/tokens",  label: "Tokens" },
 ];
 
-// Admin-only links
+// Platform-admin-only link. Settings is handled separately below — it's
+// customer-facing for org owners too, not admin-only (SAAS_PLAN.md B7).
 const adminLinks = [
   { href: "/admin", label: "Admin" },
-  { href: "/settings", label: "Settings" },
 ];
 
 function SunIcon() {
@@ -56,7 +61,7 @@ function MoonIcon() {
 }
 
 export function Nav() {
-  const { user, isAdmin, isOperator } = useAuth();
+  const { user, isAdmin, isOperator, isOrgOwner, orgId } = useAuth();
   const pathname = usePathname();
   const router = useRouter();
   const { nodes: pending } = useUnconfiguredNodes();
@@ -68,8 +73,10 @@ export function Nav() {
 
   const allLinks = [
     ...viewerLinks,
+    ...(orgId === FOUNDING_ORG_ID || isAdmin ? [tripsLink] : []),
     ...(isAdmin || isOperator ? operatorLinks : []),
     ...(isAdmin ? adminLinks : []),
+    ...(isAdmin || isOrgOwner ? [{ href: "/settings", label: "Settings" }] : []),
   ];
 
   function navLinkClass(href: string) {