feat(auth): wire handleSignupOrganization into verifyEmail (post-verification org setup)

[PierreBrisorgueil]

Summary

Promote-up from trawl_node (trawl#1317 + alignment plan 2026-05-30-trawl-devkit-perfect-alignment.md E.1).

Trawl's modules/auth/controllers/auth.controller.js calls handleSignupOrganization(user) inside verifyEmail to handle the N2 signup-grant flow: when email verification is deferred via mailer, org provisioning must run on verification — not only at signup time. Devkit's version omits this call entirely.

Why generic

handleSignupOrganization is already devkit code (in modules/organizations/services/organizations.service.js). Calling it post-email-verification is the correct place for every downstream that uses mailer-deferred verification: without it, users who verify email never get their org/grant provisioned via the email path.

The call is idempotent (A4 convergence guard: if org already exists, it converges without double-crediting).

Safety: best-effort try/catch (CRITICAL)

The call is wrapped in a try/catch — org-setup failure must NEVER fail email verification. This is the key regression risk if the wrapper is ever removed.

Files changed

• modules/auth/controllers/auth.controller.js — add user.emailVerified = true local mark + handleSignupOrganization try/catch block in verifyEmail
• modules/auth/tests/auth.verifyEmail.signup-org.unit.tests.js (new) — 2 unit tests: (1) handler called with emailVerified=true user; (2) org failure does NOT crash verifyEmail

Part of infra plan 2026-06-01-trawl-promote-up-followups.md Task 4.