First-party OAuth tokens scoped by teams instead of organizations, blocking org-level API endpoints

[charlesvien]

PostHog's scoped-project OAuth tokens cannot hit org-level endpoints (/api/organizations/{id}/projects/ returns 403). There is no single endpoint to fetch all projects across orgs for a user. The onboarding flow currently works around this by fetching each project individually via /api/projects/{id}/ -- we need a proper API endpoint for this.

This is the issue causing us to have to pick between two horrid options:

1. switchOrganization — PATCH the active org on /@me. This mutates shared state, so switching orgs in Code/Web changes what you see on us.posthog.com and vice versa.
2. Fetch each project individually, call /api/projects/{id}/ per project. N+1 requests (70+ for the PostHog org).