feat(core,api): an organisation owns hardware, and a domain says who belongs

Two kinds of machine were modelled as one. A host somebody brings is theirs,
reached through a team, and should die with their account. A host bought to
serve other people's workloads is none of those things — and there was nowhere
to put it, so it had to be registered under an employee's personal team, where
it was that person's property and their account going away took it with them.

Ownership becomes an either/or. A machine names a team or an organisation,
exactly one, enforced by a check constraint rather than by convention: both
null is a host nothing can bill, and both set is two answers to "whose is
this?" where whichever join a query happens to take decides who pays. Hardware
an organisation owns has no team and no person at all, which is the point.

The organisation is deliberately not a billing subject and has no plan columns.
It says who owns the metal; a team pays for what it uses either way.

Membership is derived from a verified email domain rather than stored. An
address is already the root identity, so a second record of who belongs where
is a second answer that can disagree with the first — and deriving it means
signing in with a personal address still gets an ordinary personal account,
which is what lets one person hold a company account and use the consumer
product. Nothing is granted on an unverified domain or an unverified address:
either one is a string somebody typed.

Entitlement on fleet hardware refuses everyone for now, with a reason that says
so. What grants a run on metered hardware is a plan, and there is nothing to
ask yet, so it fails closed rather than giving the expensive case away. The
branch is written out so the plan check has one obvious place to land.

Routes are read-only, and nothing seeds an organisation. Creating one grants
membership to everyone who can receive mail at a domain, so it is an operator
action against the database — a migration that inserted one would insert it
into every deployment, including ones we have nothing to do with. See
docs/deploy.md.

packages/core/CLAUDE.md

@@ -446,7 +446,9 @@ Game ───1:N─── Download        ← per-host game depot downloads
 
 - **User**: Person record. Email is nullable (gaming accounts don't provide one).
 - **LinkedAccount**: A gaming/OAuth identity. `(provider, providerAccountId)` is unique.
-- **Team**: Organization for billing/collaboration. First team is auto-created as "personal" team.
+- **Team**: The billing subject, and how people collaborate. The first one is auto-created as a "personal" team.
+- **Organisation**: A company. Owns hardware outright — a host serving other people's workloads, belonging to no team and no person — and gathers teams under a verified email domain. Membership is derived from that domain rather than stored. **Not a billing subject**: a team pays for what it uses whether it sits under an organisation or not.
+- **Machine**: A registered host. Owned by a team (a host somebody brought) or by an organisation (fleet hardware), never both and never neither — a check constraint, not a convention.
 - **TeamMember**: Joins User → Team with a role. `(teamId, userId)` is unique.
 
 ---
@@ -500,7 +502,15 @@ type ActorInfo =
 			properties: { userID: string; teamID: string; role: 'owner' | 'admin' | 'member' };
 	  }
 	| { type: 'system'; properties: { teamID: string } }
-	| { type: 'admin'; properties: {} };
+	| {
+			type: 'machine';
+			properties: {
+				machineID: string;
+				ownerUserID: string | null;
+				teamID: string | null;
+				organisationID: string | null;
+			};
+	  };
 ```
 
 ### API
@@ -509,8 +519,8 @@ type ActorInfo =
 Actor.use(); // → ActorInfo (throws if no context set)
 Actor.with(value, fn); // Run fn in the given actor context
 Actor.assert(type); // Assert current actor type, returns narrowed type
-Actor.type; // → 'public' | 'user' | 'member' | 'system' | 'admin'
-Actor.userID; // → string (user/member only)
+Actor.type; // → 'public' | 'user' | 'member' | 'system' | 'machine'
+Actor.userID; // → string (user/member only; refuses a machine outright)
 Actor.linkedAccountID; // → string (user only)
 Actor.useTeam; // → string (member/system only — the teamID)
 Actor.role; // → 'owner' | 'admin' | 'member' (member only)