refactor: block organization affiliation when segment name matches (CM-774)

[skwowet]

Changes

When creating a new segment (project/subproject/project group):

• Check if any organizations exist with the same name
• Block affiliations for matching organizations

When creating a new organization:

• Check if any segments exist with the same name
• Block affiliations if a match is found

---

Note

Implements automatic affiliation blocking when organization and segment names match, and centralizes org update sync/recalc triggers.

• When creating organizations, checks for a segment with the same displayName; sets isAffiliationBlocked and proceeds with normal creation and identity upsert; kicks off organizationUpdate workflow with optional OpenSearch sync
• When creating project groups/projects/subprojects, finds organizations with the same name; sets isAffiliationBlocked, applies member affiliation policy, commits, then triggers organizationUpdate workflow per affected org to recalc affiliations and sync
• Adds isAffiliationBlocked to org DB field lists and queries; updates DAL to include findOrganizationsByName (case/trim match), findSegmentByName, and makes updateOrganization return updated id
• Refactors Temporal workflow invocation into startOrganizationUpdateWorkflow and replaces direct calls in create/update paths

^{Written by Cursor Bugbot for commit fdac630. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.