feat: require org owner permission to update organization settings

- Add authorization check in organization_controller.ex update action
- Only organization owners can modify organization settings via API
- Returns 403 Forbidden if user is not an owner
- Affects all organization settings including use_sites and name
- Organization name can now be updated via API (existing field)

This ensures critical organization settings are only changed by authorized users.

lib/towerops_web/controllers/api/v1/organization_controller.ex

@@ -3,6 +3,7 @@ defmodule ToweropsWeb.Api.V1.OrganizationController do
   use ToweropsWeb, :controller
 
   import ToweropsWeb.Api.ErrorHelpers, only: [translate_errors: 1]
+  import ToweropsWeb.Permissions, only: [owner?: 1]
 
   alias Towerops.Organizations
 
@@ -13,17 +14,24 @@ defmodule ToweropsWeb.Api.V1.OrganizationController do
   end
 
   def update(conn, %{"organization" => attrs}) do
-    organization_id = conn.assigns.current_organization_id
-    org = Organizations.get_organization!(organization_id)
+    # Only organization owners can update organization settings
+    if owner?(conn.assigns.current_scope) do
+      organization_id = conn.assigns.current_organization_id
+      org = Organizations.get_organization!(organization_id)
 
-    case Organizations.update_organization(org, attrs) do
-      {:ok, updated} ->
-        json(conn, %{data: format_org(updated)})
+      case Organizations.update_organization(org, attrs) do
+        {:ok, updated} ->
+          json(conn, %{data: format_org(updated)})
 
-      {:error, changeset} ->
-        conn
-        |> put_status(:unprocessable_entity)
-        |> json(%{errors: translate_errors(changeset)})
+        {:error, changeset} ->
+          conn
+          |> put_status(:unprocessable_entity)
+          |> json(%{errors: translate_errors(changeset)})
+      end
+    else
+      conn
+      |> put_status(:forbidden)
+      |> json(%{error: "Only organization owners can update organization settings"})
     end
   end