Fix admin auth bypass: enforce GitHub org-admin checks in all environments

Previously, authorizeOrgAccess() skipped all admin authorization in
non-production environments, allowing any authenticated user to perform
admin actions (update CLAs, toggle activation, manage bypass lists) and
read admin panel data for any organization.

Changes:
- Remove blanket NODE_ENV !== "production" bypass from authorizeOrgAccess
- Add scoped DB-admin fallback for non-production (only the designated
  installer passes, not any authenticated user), consistent with
  filterInstalledOrganizationsForAdmin
- Restrict GET /api/sign/[orgSlug] to return only signing-relevant org
  fields (name, slug, avatar, isActive, claText) instead of the full
  org row which leaked adminUserId, installationId, etc.
- Remove installedOrgsCount from GET /api/orgs response to prevent
  leaking total platform org count to non-admin users

https://claude.ai/code/session_01FxG73b4jTBhGa5CK6kyKrG

Author: claude

app/api/orgs/route.ts

@@ -41,7 +41,6 @@ export async function GET() {
     return NextResponse.json({
       orgs,
       user: toSessionUserDto(user),
-      installedOrgsCount: installedOrgs.length,
     })
   } catch (err) {
     console.error("Failed to list authorized organizations:", err)

app/api/sign/[orgSlug]/route.ts

@@ -28,7 +28,10 @@ export async function GET(
 
   return NextResponse.json({
     org: {
-      ...org,
+      name: org.name,
+      githubOrgSlug: org.githubOrgSlug,
+      avatarUrl: org.avatarUrl,
+      isActive: org.isActive,
       claMarkdown: org.claText,
     },
     user: toSessionUserDto(user),

lib/server/org-access.ts

@@ -35,17 +35,21 @@ export async function authorizeOrgAccess(orgSlug: string): Promise<OrgAccessResu
     }
   }
 
-  if (process.env.NODE_ENV !== "production") {
-    return { ok: true, org, user }
-  }
-
   try {
     const isAdmin = await isGitHubInstallationAccountAdmin(user, org)
     if (!isAdmin) {
-      return {
-        ok: false,
-        status: 403,
-        message: "Forbidden: GitHub installation admin access required",
+      // In non-production, when no GitHub OAuth token is available for org-admin
+      // checks, fall back to the DB admin mapping — consistent with
+      // filterInstalledOrganizationsForAdmin. This is strictly scoped: only the
+      // designated admin (who installed the app) passes, not any authenticated user.
+      const hasDbAdminFallback =
+        process.env.NODE_ENV !== "production" && org.adminUserId === user.id
+      if (!hasDbAdminFallback) {
+        return {
+          ok: false,
+          status: 403,
+          message: "Forbidden: GitHub installation admin access required",
+        }
       }
     }
   } catch (error) {