fix: server-side belt drops firm members' legacy organisation writes

PATCH /user/profile accepted and unconditionally wrote the legacy
free-text `organisation` field. A sibling frontend PR hides the input
for firm members; this is the server-side belt.

When the caller has a non-null organisation membership, the
organisation key is now silently dropped from the update before it
reaches the DB - not rejected with a 4xx, since the field is cosmetic
(absence-not-disabled precedent, WS8 PR B). Other fields in the same
PATCH still apply. Fails OPEN on a membership-lookup error: this is a
non-destructive cosmetic write, so availability wins (WS8 PR B
precedent, not the deletion fail-SAFE direction). Orgless callers are
unaffected. The membership lookup only runs when the payload actually
touches `organisation`, avoiding an extra query on unrelated PATCHes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>