Ring creator not promoted to organizer; org owners have no permission to manage rings

## Bug After creating a ring, **no one on the org side has permission to manage it**. Two overlapping gaps: 1. **The ring creator is not automatically promoted to ring organizer.** Whoever clicked "Create ring" ends up with no organizer role on the ring they just created, so they can't edit it, invite members, or moderate. 2. **Org owners have no implicit permission to manage rings under their org.** Owning the parent org grants zero authority over its rings — the owner can't step in to configure, edit, or assign an organizer either. Combined effect: rings can be created but left in a dead state with no one able to manage them. The only workaround is a manual DB fix or an admin. ## Expected At least one of these should be true: - The user who creates a ring is automatically assigned the **ring organizer** role on that ring, **or** - The **org owner** (and possibly org admins) has implicit manage permission on all rings belonging to the org. Ideally both: creator gets organizer by default, and org owner retains a backstop manage permission in case the organizer leaves or is removed. ## Impact - Rings created through the UI are effectively orphaned on creation. - Org owners can't recover without admin intervention. - Blocks normal onboarding / self-serve ring setup flows. ## Fix direction - On ring creation: assign the creating user the `ring_organizer` role (or equivalent) in the same transaction. - In the permission model: grant org owners implicit manage rights on rings belonging to their org (either by role inheritance or by permission check that walks up to the org). ## Found by Manual testing