A first-class organizations layer for B2B-shaped apps — a fourth optional capability store, additive (nil OrgStore = feature off, zero behavior change).

• OrgStore (SetOrgStore) — Org + per-org role memberships (owner/admin/member, app-extensible). Users stay global (one account, many orgs), so email uniqueness and the safe account-linking rule are untouched. Opaque string org IDs.
• Active-org sessions — additive org/orgRole claims carry the active org only; a sole membership auto-activates. POST /auth/org/switch re-verifies membership and re-mints (SID + remaining TTL preserved). /auth/me + /auth/config surface org state.
• RequireOrgHTTP(roles…) — live re-verification per request, so off-boarding takes effect immediately, not at cookie expiry.
• Email invites, self-service member management with a lock-serialized last-owner guard, and admin org CRUD (/auth/admin/orgs, bypasses the guard as the recovery path).
• GDPR parity — DeleteUser/DeleteOrg cascade org memberships.

Full details in CHANGELOG.md.