fix: close permission review gaps

fix: harden permission-gated UI — minimum-org endpoint, modal/Popconfirm fail-closed on revocation

apps/server/src/organizations/organizations.controller.ts

@@ -25,6 +25,12 @@ export class OrganizationsController {
     private logService: OperationLogsService,
   ) {}
 
+  @Get('options')
+  @RequirePermission('organization:view', 'student:create', 'student:edit')
+  findOptions() {
+    return this.service.findOptions();
+  }
+
   @Get()
   @RequirePermission('organization:view')
   findAll(