Authentication architecture
How the backend authenticates requests — Clerk sessions, the guard stack, roles in claims, webhook org mirroring, and the two fixed-purpose API keys.
Team & organization management
The /portal/team and /portal/org surfaces — member/invitation lifecycle, the seat quota, the owner-removal guard, org rename/deletion, and the ops passthrough admin endpoints.