fix(security): enforce network health admin boundary

[bokelley]

Summary

• make the cross-organization network-health API and dashboard page platform-global-admin-only
• reject tenant-scoped WorkOS API keys before any report, alert, or page access
• bind alert resolution atomically to both the route organization and alert ID, returning a uniform 404 when no row matches
• add adversarial real-auth coverage for unauthenticated users, non-platform SSO users, tenant keys, SSO platform admins, and the static platform key

Security findings addressed

• codex-security/e7408e3c0a688491 — authenticated cross-organization network-health reads
• codex-security/979a512ad5dbb710 — alert resolution not bound to the authorized organization

Validation

• 35 focused authorization/database tests passed after rebasing onto origin/main
• server TypeScript no-emit check passed
• Semgrep: 0 findings across 210 rules on the changed runtime files
• git diff --check, package/lock guard, and dist guard passed
• independent security and testing expert reviews: CLEAN

Package metadata and generated dist files are unchanged.