CreateOrganizationAPI creates a new top-level organization owned by the
caller, for `erdo org create`. Until now org creation lived only on the internal session surface (POST /organization), which the external-surface gate keeps off-limits to API keys — so a CLI/API user had no way to create an org at all. This wrapper exposes the exact same self-serve capability the web UI already grants every authenticated non-guest user, so it widens nothing: the caller becomes the owner, guests are denied (in-handler like the managed-org mutations, plus the deny-guest tag at the edge), and scoped API keys are denied both here and by the scoped-key middleware’s hard denylist. Name/slug validation errors pass through from the organization service.
Authorizations
An Erdo API key (erdo_api_...) or scoped token (erdo_token_...).
Body
(the generator appends a numeric suffix on collision). A provided slug that is already taken is rejected rather than suffixed.
schedule the org's default heartbeats at a sensible local time. Empty is fine: provisioning falls back to UTC, and web onboarding backfills the timezone later if the owner completes it there.

