Multi-tenancy : espaces de travail + fix auth reload (rate limiter OPTIONS)

- Modèles Organization + OrgMember, migration Alembic (SQLite compatible)
- organization_id nullable sur Document, Decision, Mandate, VotingProtocol
- Service, schéma, router /organizations + dependency get_active_org_id
- Seed : Duniter G1 + Axiom Team ; tout le contenu seed attaché à Duniter G1
- Backend : list/create filtrés par header X-Organization
- Frontend : store organizations, WorkspaceSelector réel, useApi injecte l'org
- Fix critique : rate_limiter exclut les requêtes OPTIONS (CORS preflight)
  → résout le bug "Failed to fetch /auth/me" au reload (429 sur preflight)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/routers/mandates.py

@@ -22,6 +22,7 @@ from app.schemas.mandate import (
     MandateUpdate,
 )
 from app.schemas.vote import VoteSessionOut
+from app.dependencies.org import get_active_org_id
 from app.services.auth_service import get_current_identity
 from app.services.mandate_service import (
     advance_mandate,
@@ -55,6 +56,7 @@ async def _get_mandate(db: AsyncSession, mandate_id: uuid.UUID) -> Mandate:
 @router.get("/", response_model=list[MandateOut])
 async def list_mandates(
     db: AsyncSession = Depends(get_db),
+    org_id: uuid.UUID | None = Depends(get_active_org_id),
     mandate_type: str | None = Query(default=None, description="Filtrer par type de mandat"),
     status_filter: str | None = Query(default=None, alias="status", description="Filtrer par statut"),
     skip: int = Query(default=0, ge=0),
@@ -63,6 +65,8 @@ async def list_mandates(
     """List all mandates with optional filters."""
     stmt = select(Mandate).options(selectinload(Mandate.steps))
 
+    if org_id is not None:
+        stmt = stmt.where(Mandate.organization_id == org_id)
     if mandate_type is not None:
         stmt = stmt.where(Mandate.mandate_type == mandate_type)
     if status_filter is not None:
@@ -80,9 +84,10 @@ async def create_mandate(
     payload: MandateCreate,
     db: AsyncSession = Depends(get_db),
     identity: DuniterIdentity = Depends(get_current_identity),
+    org_id: uuid.UUID | None = Depends(get_active_org_id),
 ) -> MandateOut:
     """Create a new mandate."""
-    mandate = Mandate(**payload.model_dump())
+    mandate = Mandate(**payload.model_dump(), organization_id=org_id)
     db.add(mandate)
     await db.commit()
     await db.refresh(mandate)