Allow system user to manage org branding and fix logo auth

Shipped

25 ஏப்ரல், 2026 அன்று 4:20 PM UTC

Author

Kamo

Commit

bc36235

- Add system user bypass as first guard in canManageOrgBranding so platform system user has full branding control over all non-parent orgs - Fix uploadLogo endpoint which had a raw org-owner-only check that bypassed both canManageOrgBranding and god-mode, causing 403 for system user