feat: rewrite frontend auth — roles from org store, Logto org role names

Replace ID-token claim reads with org store lookups in useAuth and
usePermissions; add currentOrgRoles to useOrgStore; update role names
to Logto org role conventions (admin/member); remove username from
Layout (no longer derived from token claims).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ui/src/auth/useOrganization.ts

@@ -10,16 +10,19 @@ export interface OrgInfo {
 interface OrgState {
   currentOrgId: string | null;      // Logto org ID — used for getAccessToken(resource, orgId)
   currentTenantId: string | null;   // DB UUID — used for API calls like /api/tenants/{id}
+  currentOrgRoles: string[] | null; // Logto org roles for the current org (e.g. 'admin', 'member')
   organizations: OrgInfo[];
   isPlatformAdmin: boolean;
   setCurrentOrg: (orgId: string | null) => void;
   setOrganizations: (orgs: OrgInfo[]) => void;
   setIsPlatformAdmin: (value: boolean) => void;
+  setCurrentOrgRoles: (roles: string[] | null) => void;
 }
 
 export const useOrgStore = create<OrgState>((set, get) => ({
   currentOrgId: null,
   currentTenantId: null,
+  currentOrgRoles: null,
   organizations: [],
   isPlatformAdmin: false,
   setCurrentOrg: (orgId) => {
@@ -36,4 +39,5 @@ export const useOrgStore = create<OrgState>((set, get) => ({
     });
   },
   setIsPlatformAdmin: (value) => set({ isPlatformAdmin: value }),
+  setCurrentOrgRoles: (roles) => set({ currentOrgRoles: roles }),
 }));