An explicit organization_id field is the organization a write sends #39

Parent

#37

What to build

Write requests made through the raw api command carry exactly one organization, and it is the one the caller named. When organization_id is passed as a field, that value travels in the JSON object body and the profile's organization is not also appended to the query string; when no organization is named, the profile's organization still travels — in the body, matching the documented rule that writes carry the organization in the body. A caller can then delete or update another organization's resource by naming it, and the platform's parameter merge can no longer hand the server a different organization than the one the caller wrote.

Acceptance criteria

• A write verb (POST, PUT, PATCH, DELETE) with -f organization_id=<other> sends <other> in the JSON body and no organization_id on the query string.
• The same holds for -F organization_id=<other> (typed value).
• A write with no explicit organization still carries the profile's organization, in the body only — no query-string copy.
• A request whose body cannot carry the organization (raw --input bytes, or a non-object JSON body) keeps the organization on the query string so the request stays scoped.
• GET behaviour is unchanged: fields travel on the query string and an organization_id there (or on the endpoint query) suppresses injection.
• Wire-level tests capture the outgoing request (method line, query string, body) and assert the organization appears exactly where the rules above say; covered in the existing mock-server test group for raw requests.

Blocked by

• None — can start immediately.