[2b] User and department management

[andrmaz]

What to build

Admin can create departments within an organization and assign users to departments via a UserDepartment junction. Department assignments are persisted and surfaced in authenticated session context so downstream request paths can resolve department scope per user.

Acceptance criteria

• Admin can create and list departments scoped to an organization.
• Admin can assign a user to one or more departments.
• Department assignment is reflected in the authenticated user's session/token claims.
• Admin UI pages exist for departments and user assignment.
• Integration tests cover assignment and session-enrichment paths.

Blocked by

• [2a] Organization CRUD — admin API + UI #3 [2a] Organization CRUD — admin API + UI

[andrmaz]

@cursoragent start working on this

[cursor]

I've implemented the "User and department management" feature and opened a draft PR.

What I built:

• Departments admin API — GET/POST /api/admin/organizations/:organizationId/departments to create and list departments scoped to an organization (404 on unknown org, 409 on duplicate name).
• Users listing admin API — GET /api/admin/organizations/:organizationId/users, needed so the admin UI can pick a user to assign.
• UserDepartment assignment API — GET/PUT /api/admin/users/:userId/departments, which set-replaces a user's department assignments and designates one primary department. It validates every department belongs to the user's own organization and writes inside a transaction (clearing existing primary flags before setting the new one) so the DB's "one primary per user" constraint is never violated mid-write.
• Session enrichment — GET /api/me now returns departmentIds and primaryDepartmentId alongside the existing JWT claims. This is resolved live from the UserDepartment table on every request rather than baked into the JWT, so admin reassignment is visible immediately without waiting for the token to expire.
• Admin Web UI — new /admin/departments (org picker + list + create form) and /admin/users (org picker + user list + checkbox/radio assignment form) pages, plus quick links from the Organizations table.
• Tests — unit tests for the new services (including primary-department resolution edge cases and cross-org validation) and integration tests covering department CRUD, assignment, and the session-enrichment path (including a test that reflects a new assignment on an already-issued token).

Verification: all 152 API tests pass, pnpm check-types/pnpm lint are clean across the monorepo, and apps/web builds successfully with the new routes. I didn't attempt a live end-to-end boot of @cortex/api since there's a pre-existing, documented gap unrelated to this change (missing Prisma driver adapter wiring) that already prevents the compiled API from starting — I verified through the Jest integration suite instead, consistent with the repo's documented guidance for that gap.