fix: expose safe organization lookup error codes in session responses

tests/worker-organization.test.js

@@ -100,6 +100,25 @@ test('organization service failure does not break an existing authenticated sess
       assert.equal(body.authenticated, true);
       assert.equal(body.user.requesterId, USER);
       assert.equal(body.user.orgContextStatus, 'unavailable');
+      assert.equal(body.user.orgContextError, 'org_context_http_503');
+    });
+  } finally { console.error = original; }
+});
+test('session exposes only a safe configuration error when runtime organization credentials are missing', async () => {
+  const env = configuration({ ORG_CONTEXT_KEY_SECRET: '' });
+  const original = console.error;
+  console.error = () => {};
+  try {
+    await mockedFetch(() => assert.fail('configuration error must precede network access'), async () => {
+      const response = await worker.fetch(new Request('https://qa.example.test/auth/session', { headers: { cookie: sessionCookie(env) } }), env);
+      const body = await response.json();
+      assert.equal(response.status, 200);
+      assert.equal(body.authenticated, true);
+      assert.equal(body.user.requesterId, USER);
+      assert.equal(body.user.orgContextStatus, 'unavailable');
+      assert.equal(body.user.orgContextError, 'org_context_missing_credentials');
+      assert.ok(!JSON.stringify(body).includes('integration-key'));
+      assert.ok(!JSON.stringify(body).includes('signed-session-fixture'));
     });
   } finally { console.error = original; }
 });