Clients, Organizations, and OrganizationUsers services are unauthenticated #47

Files: core/csharp/MicroZen.Api/Services/ClientsGrpcService.cs, OrganizationsService.cs, OrganizationUsersService.cs

What this is: Only ClientApiKeysService has [Authorize]. The Clients, Organizations, and OrganizationUsers gRPC services have no [Authorize] attribute at all.

Problem: Every Client/Organization read, create, update, delete, and the OAuth2-credential endpoints are reachable with no authentication. The // TODO - Add [Policy...] comments confirm tenant checks were never wired up, so any caller can read or delete any organization's clients and OAuth2 secrets.

Fix: Add [Authorize] to these service classes and implement the tenant/ownership check the TODOs describe before shipping.

If we skip it: Full cross-tenant data exposure and destruction with no credentials.