server/crm: separate search actor from account filter

[Blaec-CoCalc]

What changed

• Renamed the optional organization linked-account selector from account_id to linked_account_id.
• Kept authenticated actor identity exclusively in account_id through public Conat and seed dispatch.
• Updated the CLI --account mapping.
• Added regressions for CLI forwarding, Conat payload separation, UUID/customer-number/display-name lookup with an unrelated admin actor, and explicit linked-account filtering.

Why

The CRM transport injects the authenticated admin as account_id. Organization search also interpreted that field as a linked-person account filter, so every ordinary query was silently AND-filtered to organizations linked to the querying admin. Unlinked organizations therefore returned zero results even when UUID, customer number, or display name matched.

Risk / impact

• This is an internal typed API field rename. The CLI and server should be deployed together for --account filtering.
• Ordinary frontend query callers do not set the renamed field and remain compatible.
• During a mixed-version rollout, searches remain incorrect until the authoritative seed bay runs this change.
• Authorization, feature flags, seed ownership, result bounds, and PII handling are unchanged.

Validation

• pnpm -C src/packages/conat build — passed.
• pnpm -C src/packages/server build — passed.
• pnpm -C src/packages/cli build — passed.
• pnpm -C src/packages/cli test -- src/bin/commands/admin/crm.test.ts — 18/18 passed.
• Focused Conat/store PGlite run — 2 suites, 14/14 tests passed.
• Explicit server CRM PGlite run — 11 suites, 41/41 tests passed.
• Repository-pinned Prettier reported all six files unchanged.
• git diff --check — clean.
• Independent read-only audit of the exact committed tree — no findings.

Validation limitation: ./workspaces.py version-check cannot run on current main because it invokes the absent src/scripts/check_npm_packages.py; no dependency versions changed in this PR.

Rollback

Revert this commit and redeploy the seed/client pair. This PR has no schema or data migration.

Workbus

No Workbus task ID was provided.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}