Org-scoped Console device sign-in and group-name-native entries

[grikomsn]

Org-scoped Console device sign-in + group-name-native entries

Two user-facing changes, validated together.

Org-scoped device sign-in

Console device authorization now requests organization scoping (supports_org_scope) and honors a server-granted organization (org_id) from the token grant and refresh responses.

• Sessions that Console scoped to an organization can no longer switch organizations locally — sign in again to choose a different one, and refreshes reject a scope change.
• Multi-organization accounts without a server scope are no longer pinned to the first organization automatically; pick one after sign-in or from Manage (single-organization accounts still self-select).
• Refreshes that return a new organization notify model catalogs so they re-provision for the new organization.
• Covered by dedicated tests for grant honoring, unavailable-org rejection, local-switch blocking, refresh scope-keeping/rejection/adoption, and org-picker deferral. docs/org-scoped-device-auth-plan.md is committed as the decision record for the design.

Group-name-native entries (completes the registration overhaul)

• Entries no longer carry an entryId (manifest property removed for both vendors): model IDs are the raw hosted IDs — the host namespaces them per entry group.
• Key entries are scoped by their API-key fingerprint; labels come from the user-typed group name; deleting or re-adding an entry re-provisions its credential without stale-handle rejection.
• The Extension Development Host harness (test/native/index.js) was updated to the new contract (raw IDs, fingerprint refs, keyless-entry behavior).
• README/setup already described this flow; the changeset now covers it.

Validation

• npm run check green: 183/183 tests (Node 22/24/26 in CI).