feat: organization-scoped species activation API (#1222)

[FangHsin0122]

Summary

Backend work for Greenstand/treetracker-admin-client#1222, which adds organization-scoped species activation. This PR only covers the backend. The frontend part of #1222 (species dropdown in admin-client) is being handled separately.

• Added a new OrganizationSpecies junction table, along with the model, repository, and controller
• GET /organization/{organizationId}/species — returns the species available to the organization, filtered to active mappings and active species
• POST .../activate — returns 422 if the target species is globally inactive
• POST .../deactivate — idempotent
• Added list_species / manage_org_species auth policies, matched by org ID
• Added a one-time backfill script (backfill:organization-species) that rebuilds the initial mappings from historical trees.species_id usage, so existing organizations don't end up with an empty species list after rollout

Dependency

The companion treetracker-database migration (AddOrganizationSpeciesTable) needs to be merged and deployed first.
Link: Greenstand/treetracker-database#124

Testing

• npm run build / npm run lint: clean
• npx jest --ci: 42 passed, 0 failed, including the new auth policy coverage
• Manual endpoint matrix against a local Postgres database restored from the real schema: 18/18 passed, covering org-scoped lists, hierarchy inheritance, cross-org 401s, read/write policy separation, the retired-species 422 guard, idempotent deactivate, and legacy route regression
• Verified the backfill script with dry run → real run → idempotent rerun against fixture data