[Priyanshu-u07]

Node and worker routes now act only on nodes and pools that belong to the caller's organisation. This completes the ownership checks started in #416 and #417.

• Every /v1/nodes/{node_id} route (get, log-stream, deploy-metrics, labels, delete, provisioning retry, depin-details, provisioning, provisioning-logs, ec2-console) answers 404 for a node outside the caller's org, before any work, through one _require_own_node dependency.
• The worker-admin routes do the same: minting a bootstrap token, listing a pool's workers, revoking a worker and node metrics.
• /v1/nodes/xds-status lists only the caller's nodes. The xDS control plane reads the repository directly and is unaffected.
• ownership.py gains owns_pool_id and owns_node, used by these routes and by the worker shell and log websockets. A failed lookup, or a pool without owner fields, owns nothing.
• The CLI's node and worker commands take --org-id (or INFERIA_ORG_ID) and refuse to run without one. models commands are unchanged; the model cache is not per-org.

Tests cover each route for another org, an empty org, "None", no org, the owning org and a system pool, plus the CLI with and without an org; the cross-org cases fail on main. Verified on a local stack through the gateway, the CLI and the dashboard's Add worker flow.