Add organizations module surface

AGENTS.md

@@ -3,7 +3,7 @@
 ## Scope
 
 This repository owns the canonical GovOPlaN organizational model: tenant-local
-organization units, hierarchy, functions, and account-held function
+organization units, parallel structures, functions, and identity-held function
 assignments.
 
 The module describes responsibility in the institution. It does not decide
@@ -14,11 +14,16 @@ facts to roles, rights, permission decisions, and explainability.
 
 - Depend on kernel contracts from `govoplan-core`.
 - Depend on `govoplan-tenancy` for tenant ownership.
-- Do not import access, identity, postbox, workflow, or portal internals.
+- Depend on identity only through kernel capabilities when resolving account to
+  identity relationships.
+- Do not import access, admin, identity, postbox, workflow, or portal internals.
 - Expose integration through manifests, capabilities, API routes, events, and
   typed DTOs.
 - Treat function assignment as organizational responsibility, not as a login
   permission by itself.
+- Keep the organization modelling UI as a standalone module route. Admin-only
+  organization controls should be contributed by this module through the
+  platform `admin.sections` WebUI capability.
 
 ## Local Workflow