refactor: remove remaining organisation residue

[simonjcarr]

Summary

• remove the remaining active legacy org terminology from ct-ops web, ingest, agent, workflow, docs, and tests
• rename org_admin residue to instance_admin with a migration for persisted values/index names
• remove the CT_OPS_ORG_TOKEN compatibility fallback and switch CT-CVE/password-manager/activation-token surfaces to instance naming
• rename the remaining organisation-name E2E spec path to instance-name

Validation

• pnpm install --frozen-lockfile
• pnpm --dir apps/web db:validate
• pnpm --dir apps/web type-check
• pnpm --dir apps/web lint
• pnpm --dir apps/web test:unit
• pnpm --dir apps/web exec node --experimental-strip-types --test lib/integrations/ct-cve/connector-settings.test.mjs lib/integrations/ct-cve/setup-status.test.mjs
• pnpm --dir apps/web exec playwright test --list
• pnpm --dir apps/docs build
• go test ./... (agent)
• go test ./... (apps/ingest)
• git diff --check
• gitleaks detect --redact --report-format sarif --report-path /tmp/ct-ops-gitleaks-replacement.sarif --log-opts "origin/main..HEAD" --verbose
• legacy residue rg scan excluding transitional migration metadata

Notes

• Browser E2E execution was attempted for activation/enrolment specs but this local environment is missing DB env (POSTGRES_PASSWORD/DATABASE_URL), so Playwright discovery was used locally and CI remains the full gate.
• CT Portal compatibility for the renamed activation token fields is tracked in carrtech-dev/ct-portal#44.
• Supersedes refactor: remove remaining organisation residue #1408; this replacement branch removes the gitleaks-triggering fixture strings from the commit history instead of carrying the old failed commit.

[simonjcarr]

Superseded by #1411. The replacement branch rebases onto latest main and fixes the newly landed docker E2E getOrgId residue in the PR merge ref.

[simonjcarr]

Closing in favor of #1411.