Organization shared projects

Team organizations can create shared projects with specialty ownership zones, an event feed for notifications, and a PM cockpit API.

Prerequisites

Run SQL in this order after organizations:

Concept	Meaning
`org_projects`	Shared project bound to an org (repo URL, default branch)
`org_project_members`	Roles: `lead` (PM), `contributor`, `observer` + specialty label
`org_ownership_zones`	Path globs per member (`webui/`, `navin/`, …)
`org_project_events`	Append-only feed (PR, conflict, ticket, report, …)

Assign each contributor a specialty and one or more path globs.
Before commit / PR, call POST /api/orgs/projects/:id/check-ownership with the changed paths.
Paths with no owner are allowed (greenfield).
Paths owned by someone else are blocked unless a project lead forces the change.
Prefer one board ticket → one branch feat/<ticket-id>-slug.

Local helper (Python): navin.collab.ownership.

Method	Path
GET/POST	`/api/orgs/projects`
GET	`/api/orgs/projects/[projectId]`
POST	`/api/orgs/projects/[projectId]/members`
POST	`/api/orgs/projects/[projectId]/zones`
GET/POST	`/api/orgs/projects/[projectId]/events`
POST	`/api/orgs/projects/[projectId]/check-ownership`

All require a logged-in navin.live session (same-origin). Writes use the service role server-side.

Specialty	Zones (example)
Frontend	`webui/`, `site/src/components/`
Backend	`navin/`, `site/src/app/api/`
Data / SQL	`site/supabase/**`
QA / Security	`tests/**`
Project lead	no code zones (lead role + cockpit)

Members with project_role = lead (or org admin) manage members and zones.
Org viewer can read project events when granted project membership as observer.
Poll GET .../events or the detail endpoint for a live activity stream.
Emit report / blocker / conflict events from CI, git hooks, or the agent.