Stamp org_id on tenant writes; scope public reads to the site org

[WebTigers]

Content was never attributed to a tenant — CMS pages and blog articles saved with org_id='', while everything else set it. That blocks a clean multi-site story and isn't honest attribution. Fixed in the base model so it can't be forgotten per-module.

Write side

• Tiger_Model_Table: setOrg()/$_org + auto-stamp org_id on insert (mirrors the created_by actor stamp) for any table with the column. Explicit org_id wins; no org set (system/global) keeps ''. The Authorization plugin wires setOrg() from the authenticated org, right next to setActor().

Read side

• Tiger_Model_Org::siteOrgId()/setSiteOrgId() — the org that owns the public site: configured tiger.site.org_id, else the founding (oldest) org. (NB parent_org_id is future — all orgs are root today — so it's not a distinguishing query.)
• PageDispatch + blog article resolve pass siteOrgId(); _orgScope('') resolves to it too, so blog lists / CMS datatable / redirects scope to the site without touching each caller. Scope stays [org, ''] → nothing 404s mid-transition. This is the exact seam a multi-site module overrides by host.

Data

• Migration 0033 backfills legacy page.org_id='' → the site org (callable migration; empty DBs no-op).

Verification

• Smoke now seeds an org-stamped published page and asserts its body dispatches at its public URL — the guard for the write-stamp ↔ read-scope path (a mismatch 404s there). This exercises base-model stamping + public dispatch end-to-end on a fresh install, which nothing did before.
• Migration 0032's transform was unit-tested previously; 0033 uses the same callable-migrator path.

Single-site behavior is unchanged (founding org = the one site); this is the groundwork the future multi-site module drops onto.

🤖 Generated with Claude Code