org-applications: approve and reject are one call each to
decide_application() (El3ab docs/redeem-contract.md 7.5), which adds or
upgrades the membership, runs any grants a code application was holding and
records the staff reviewer in reviewed_by_admin, all in one transaction. The
player is notified only after it answers ok, with the org's name from that
answer in title_ar/body_ar and the reviewer's note or reason in the body.
The old code wrote missing columns and an admin id into a profiles key, so
nothing was ever approved, and then told the player they were in. Bulk
approve and reject go through the same path (up to 50) and say how many
failed and why. The list and show pages read el3ab_organizations (the org
column was blank for all 13), with per-status counts and the cancelled
status. The proof is shown through a ten-minute signed link, from the
private org-proofs bucket when the file is there (core/ProofDocument.php),
and a proof still sitting in the old public bucket is flagged. Signed links
now carry the apikey Kong requires.

Org scoping: core/OrgScope.php, called by the Router before every route,
keeps an org-scoped staff account (admin_users.org_id) inside its own org:
the org in organizations/{id}/... and {orgId}, the owner org of any record
named in the path (application, code, event, channel, frame, transfer, ...),
and org ids in the query or form are all checked with Auth::canAccessOrg;
lists are pinned to the account's org, the org directory goes straight to
it, and modules the role has no permission for at all are refused.
OrgPermissions uses player_id and status='active', ranks moderator with
arbiter, and treats an org-scoped staff account as the owner of its own org
only, as the database functions do.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>