Organizations
GET /v0/organizations returns the org with live inbox_count,
domain_count, inbox_limit and domain_limit.
New agent signups start unverified: capped limits plus a send allowlist
containing only the human’s address. POST /v0/agent/verify with the OTP
lifts both (verified: true, allowlist removed). GET /v0/auth/me shows the
calling key’s org, scope and permissions.