fix(web): honor organization header in defaults endpoint

[chrarnoldus]

Summary

• Honor X-KiloCode-OrganizationId on GET /api/defaults by delegating to the existing organization defaults handler.
• Preserve anonymous personal defaults when the header is absent; propagate organization authorization and policy failures without falling back to personal defaults.
• Run the existing organization-defaults regression cases against both routes and cover missing/invalid headers and authorization failures.

Validation

• Changed-file formatting and oxlint: passed locally.
• git diff --check: passed.
• Tests intentionally not run locally, per request. Local web typecheck exceeded the two-minute limit.
• CI: tests, typecheck, lint, format, build, Drizzle check, extension verification/build, browser E2E, and secret scan all passed.
• Kilo Code Review completed with no issues found.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• apps/web/src/app/api/defaults/route.ts
• apps/web/src/app/api/organizations/[id]/defaults/route.test.ts

---

_{Reviewed by grok-4.6 · Input: 129.7K · Output: 8.9K · Cached: 305.4K}

_{Review guidance: REVIEW.md from base branch main}