fix: let permission-denied redirect propagate in org settings action

Author: nicktrn

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings._index/route.tsx

@@ -295,6 +295,9 @@ export const action = dashboardAction(
         }
       }
     } catch (error: unknown) {
+      // Permission checks throw a redirect Response (toast) — let it through
+      // rather than flattening it into a generic 400.
+      if (error instanceof Response) throw error;
       const message = error instanceof Error ? error.message : "An unexpected error occurred";
       return json({ errors: { body: message } }, { status: 400 });
     }

apps/webapp/app/routes/api.v1.orgs.$orgParam.projects.ts

@@ -77,7 +77,8 @@ export const action = createActionPATApiRoute(
       });
       return org ? { organizationId: org.id } : {};
     },
-    // authorization intentionally omitted — gating TBD
+    // No authorization gate: creating a project is a member-level action
+    // (mirrors the dashboard), not an owner-only one like rename/delete.
   },
   async ({ params, body, authentication }) => {
     const organization = await prisma.organization.findFirst({