feat(org): enforce tenant isolation in ws/kc with leave and stats APIs

Add org_id schema migrations and service-level filtering for teacher-student and class workflows, then cover org-context behavior with focused unit/e2e tests for leave and hour statistics.

Made-with: Cursor

htyts/tests/ts_e2e_http.rs

@@ -50,6 +50,8 @@ fn mint_sudo_jwt() -> String {
         ts: Utc::now().naive_utc(),
         roles: None,
         tags: None,
+        current_org_id: None,
+        current_org_role_keys: None,
     };
     jwt_encode_token(inner).expect("jwt_encode_token")
 }