fix: use correct auth check for API organization updates

- API auth uses current_user, not current_scope
- Check membership role directly instead of using owner?/1 helper
- Allow superusers to update organization settings
- Fixes KeyError: key :current_scope not found

Previous code assumed LiveView context with current_scope, but API
requests only have current_user and current_organization_id assigned.

lib/towerops_web/controllers/api/v1/organization_controller.ex

@@ -3,7 +3,6 @@ defmodule ToweropsWeb.Api.V1.OrganizationController do
   use ToweropsWeb, :controller
 
   import ToweropsWeb.Api.ErrorHelpers, only: [translate_errors: 1]
-  import ToweropsWeb.Permissions, only: [owner?: 1]
 
   alias Towerops.Organizations
 
@@ -15,10 +14,14 @@ defmodule ToweropsWeb.Api.V1.OrganizationController do
 
   def update(conn, %{"organization" => attrs}) do
     # Only organization owners can update organization settings
-    if owner?(conn.assigns.current_scope) do
-      organization_id = conn.assigns.current_organization_id
-      org = Organizations.get_organization!(organization_id)
+    user = conn.assigns.current_user
+    organization_id = conn.assigns.current_organization_id
+    org = Organizations.get_organization!(organization_id)
 
+    # Check if user is owner (or superuser)
+    membership = Organizations.get_membership(org.id, user.id)
+
+    if user.is_superuser || (membership && membership.role == :owner) do
       case Organizations.update_organization(org, attrs) do
         {:ok, updated} ->
           json(conn, %{data: format_org(updated)})