refactor: remove remaining organisation residue

[simonjcarr]

Summary

• remove remaining active legacy org terminology from ct-ops web, ingest, agent, workflow, docs, and tests
• rename org_admin residue to instance_admin with a migration for persisted role/index metadata
• remove the CT_OPS_ORG_TOKEN compatibility fallback and switch CT-CVE/password-manager/activation-token surfaces to instance naming
• rename the remaining organisation-name E2E spec path to instance-name and update latest-main docker E2E residue

Validation

• pnpm install --frozen-lockfile
• pnpm --dir apps/web db:validate
• pnpm --dir apps/web type-check
• pnpm run type-check
• pnpm --dir apps/web lint
• pnpm --dir apps/web test:unit
• pnpm --dir apps/web exec node --experimental-strip-types --test lib/integrations/ct-cve/connector-settings.test.mjs lib/integrations/ct-cve/setup-status.test.mjs
• pnpm --dir apps/web exec playwright test --list
• pnpm --dir apps/docs build
• go test ./... (agent)
• go test ./... (apps/ingest)
• git diff --check
• gitleaks detect --redact --report-format sarif --report-path /tmp/ct-ops-gitleaks-ci-fix-amended.sarif --log-opts "origin/main..HEAD" --verbose
• legacy residue rg scan excluding transitional migration metadata

Notes

• Browser E2E execution was attempted for activation/enrolment specs but this local environment is missing DB env (POSTGRES_PASSWORD/DATABASE_URL), so Playwright discovery was used locally and CI remains the full gate.
• CT Portal compatibility for the renamed activation token fields is being handled before this is merged; see carrtech-dev/ct-portal#44.
• Supersedes refactor: remove remaining organisation residue #1410 and refactor: remove remaining organisation residue #1408.