fix(webapp): resolve the org scoped to membership on the settings routes

The runtime-updates loader and the settings side-menu deployment gate both
resolved the organization from the slug alone and relied on the RBAC
authorization check to reject a non-member. Use the membership-scoped
resolver instead, matching the Team settings loader: the ability check
enforces the role, the membership filter is the tenant floor. An
unresolved org yields no scope, which the dashboard route builder and the
side-menu helper both already fail closed on.

Author: claude

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.runtime-updates/route.tsx

@@ -1,8 +1,9 @@
 import { NODE_RUNTIME_UPDATE_MAJOR } from "@trigger.dev/core/v3";
 import { typedjson, useTypedLoaderData } from "remix-typedjson";
-import { resolveOrgIdFromSlug } from "~/models/organization.server";
+import { resolveOrgIdFromSlugForUser } from "~/models/organization.server";
 import { listCurrentProductionProjectRuntimes } from "~/services/projectRuntimeUpdates.server";
 import { dashboardLoader } from "~/services/routeBuilders/dashboardBuilder";
+import { getUserId } from "~/services/session.server";
 import { pageMeta } from "~/utils/pageTitle";
 import { OrganizationParamsSchema } from "~/utils/pathBuilder";
 import { type ProjectRuntimeRow, RuntimeUpdatesPage } from "./RuntimeUpdatesPage";
@@ -12,8 +13,12 @@ export const meta = pageMeta("Projects");
 export const loader = dashboardLoader(
   {
     params: OrganizationParamsSchema,
-    context: async (params) => {
-      const organizationId = await resolveOrgIdFromSlug(params.organizationSlug);
+    // Membership-scoped resolve, like the Team settings loader: the RBAC gate below enforces the
+    // role, this is the tenant floor. An unresolved org yields no scope, which fails closed.
+    context: async (params, request) => {
+      const userId = await getUserId(request);
+      if (!userId) return {};
+      const organizationId = await resolveOrgIdFromSlugForUser(params.organizationSlug, userId);
       return organizationId ? { organizationId } : {};
     },
     authorization: {

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings/route.tsx

@@ -10,7 +10,7 @@ import {
   OrganizationSettingsSideMenu,
 } from "~/components/navigation/OrganizationSettingsSideMenu";
 import { useOrganization } from "~/hooks/useOrganizations";
-import { resolveOrgIdFromSlug } from "~/models/organization.server";
+import { resolveOrgIdFromSlugForUser } from "~/models/organization.server";
 import { organizationHasProjectRuntimeUpdate } from "~/services/projectRuntimeUpdates.server";
 import { rbac } from "~/services/rbac.server";
 import { requireUserId } from "~/services/session.server";
@@ -29,7 +29,8 @@ async function canReadDeployments({
   userId: string;
   organizationSlug: string;
 }) {
-  const organizationId = await resolveOrgIdFromSlug(organizationSlug);
+  // Membership-scoped so the dot is never computed against an org the user is not in.
+  const organizationId = await resolveOrgIdFromSlugForUser(organizationSlug, userId);
   if (!organizationId) {
     return false;
   }