GeezerVison

Adds an organization filter to GET /api/v2/ai-gateway/sessions (and its /api/v2/aibridge/sessions alias) and returns the organization an interception was attributed to, and how it was chosen, on sessions, threads and agentic actions, as proposed in the surface definitions on AIGOV-754. No migration: aibridge_interceptions.organization_id and organization_source already exist (000634).

The filter accepts an organization name or ID and keeps sessions with at least one interception in that organization; the count uses the same rule so pagination totals match. Each session, on the list and detail responses, lists the organizations its interceptions were attributed to, ordered by name, with the distinct sources used for each, or [] when none was stored. Each thread carries the organization of its root interception and each agentic action carries its own, or null when none was stored. The new filter is listed in the AI Gateway monitoring docs.

Refs AIGOV-754

Open questions for reviewers

• Multi-org sessions (AIGOV-776): the filter is row-level, like provider and model. A session spanning two orgs is listed under each org's filter, and with the filter on, threads, started_at and ended_at only cover the matching interceptions, while providers, models, tokens and organizations cover the whole session. Is that the desired behavior?
• Unknown org ID: an unknown org name returns 400, but an unknown org ID returns an empty page, because parseOrganization does not look up UUIDs. This matches workspaces and templates, but the spec says 400.

Notes for reviewers

• aiBridgeSessionOrganizations returns an empty list if the organizations JSON from the query can’t be decoded, rather than failing the whole request. The field is supplementary, so a decoding problem shouldn’t take down the sessions list, but it does mean a SQL bug here would show up as empty data rather than an error. The alternative is to log the error before returning the empty list.
• A thread’s organization is taken from its root interception only. If later requests in the same thread were attributed to a different organization, that shows on each agentic action’s own organization field.

Code written by @mollymaefraser, with Coder Agents used as a guide: explaining the existing code path, reviewing each step, and running tests.