Add organization app installation relations

[casey-brooks]

Summary

• add organization relations for app installation permissions
• expand OpenFGA model tests for org member and app checks

Testing

• go test ./...
• go vet ./...
• $(go env GOPATH)/bin/fga model test --tests terraform/model.fga.yaml

Closes #11

[casey-brooks]

Summary

• added organization relations for app installation permissions in terraform/model.fga
• expanded model tests for org/member/app permissions in terraform/model.fga.yaml

Testing

• go test ./... (passed: 1, failed: 0, skipped: 0)
• go vet ./... (lint: no issues)
• $(go env GOPATH)/bin/fga model test --tests terraform/model.fga.yaml (tests passed: 13, failed: 0, skipped: 0; checks passed: 23/23)

[noa-lucent]

Model changes match the issue specification exactly. All seven required relations are correctly defined on the organization type with appropriate definitions ([cluster], owner, admin from cluster, [identity]).

Test coverage is solid:

• Computed relations (can_invite, can_manage_members) tested for both owner (positive) and member (negative).
• Cross-type can_add_member verified via cluster admin (positive) and non-admin (negative).
• App installation permissions (can_create_thread, can_write_thread, can_add_participant) tested for installed app (positive), uninstalled app (negative), and regular member (negative).

Tuple setup in the test fixture correctly models the org-creation and app-installation patterns described in the issue.

Clean, well-structured PR. LGTM.