Fix Integration API organization delete (regression of #1376)

DELETE /v1/org/{orgId} on the Integration API always returned
500 "An error occurred..." and left the organization in place, even for a
root API key holding the deleteOrg action. The handler looked up the
caller's ownership with req.user!.userId, but Integration API requests are
authenticated by verifyApiKey, which sets req.apiKey and never req.user,
so the lookup threw "Cannot read properties of undefined (reading
'userId')".

#1376 was fixed in f37eda47 by dropping the user-only permission check;
79cf7c84 later added the owner check to the handler shared by both
routers, reintroducing the failure for API keys.

Keep the owner check for dashboard sessions. For Integration API keys the
route is already restricted by verifyApiKeyIsRoot and
verifyApiKeyHasAction(deleteOrg), so load the organization directly. Both
paths still refuse a billing organization and return the same 404 for an
unknown organization.

Verified against a local SQLite instance with a root key: before the
change, create returned 201 and delete returned 500 with the organization
still present; after it, delete returns 200 and a repeated delete or GET
returns 404. npx tsc --noEmit passes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/routers/org/deleteOrg.ts

@@ -7,7 +7,7 @@ import logger from "@server/logger";
 import { fromError } from "zod-validation-error";
 import { OpenAPITags, registry } from "@server/openApi";
 import { deleteOrgById, sendTerminationMessages } from "@server/lib/deleteOrg";
-import { db, userOrgs, orgs } from "@server/db";
+import { db, Org, userOrgs, orgs } from "@server/db";
 import { eq, and } from "drizzle-orm";
 
 const deleteOrgSchema = z.strictObject({
@@ -59,35 +59,60 @@ export async function deleteOrg(
         }
         const { orgId } = parsedParams.data;
 
-        const [data] = await db
-            .select()
-            .from(userOrgs)
-            .innerJoin(orgs, eq(userOrgs.orgId, orgs.orgId))
-            .where(
-                and(
-                    eq(userOrgs.orgId, orgId),
-                    eq(userOrgs.userId, req.user!.userId)
-                )
-            );
+        let org: Org | undefined;
 
-        const org = data?.orgs;
-        const userOrg = data?.userOrgs;
+        if (req.user) {
+            // Dashboard sessions may delete only an organization the user owns.
+            const [data] = await db
+                .select()
+                .from(userOrgs)
+                .innerJoin(orgs, eq(userOrgs.orgId, orgs.orgId))
+                .where(
+                    and(
+                        eq(userOrgs.orgId, orgId),
+                        eq(userOrgs.userId, req.user.userId)
+                    )
+                );
 
-        if (!org || !userOrg) {
+            if (!data) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Organization with ID ${orgId} not found`
+                    )
+                );
+            }
+
+            if (!data.userOrgs.isOwner) {
+                return next(
+                    createHttpError(
+                        HttpCode.FORBIDDEN,
+                        "Only organization owners can delete the organization"
+                    )
+                );
+            }
+
+            org = data.orgs;
+        } else if (req.apiKey) {
+            // Integration API requests carry no user session. The route is already
+            // restricted by verifyApiKeyIsRoot and verifyApiKeyHasAction(deleteOrg).
+            [org] = await db
+                .select()
+                .from(orgs)
+                .where(eq(orgs.orgId, orgId))
+                .limit(1);
+
+            if (!org) {
+                return next(
+                    createHttpError(
+                        HttpCode.NOT_FOUND,
+                        `Organization with ID ${orgId} not found`
+                    )
+                );
+            }
+        } else {
             return next(
-                createHttpError(
-                    HttpCode.NOT_FOUND,
-                    `Organization with ID ${orgId} not found`
-                )
-            );
-        }
-
-        if (!userOrg.isOwner) {
-            return next(
-                createHttpError(
-                    HttpCode.FORBIDDEN,
-                    "Only organization owners can delete the organization"
-                )
+                createHttpError(HttpCode.UNAUTHORIZED, "Not authenticated")
             );
         }