Feat(Chore): Verify Flow, Invites, Suspend, Depart Cert Policy

feat: add password reset and email verification flow
feat: add org invite listing, cancellation, and invite link fallback
feat: add user suspend/unsuspend with audit logging
feat: add department certificate policy (expiry, extensions)
feat: enforce dept cert policy on SSH certificate signing
feat: wire up OIDC consent and token flow (replace mocks)
feat: rework CLI auth bridge to use frontend login flow
feat: add admin OAuth provider management (CRUD)
chore: refactor model import paths after module reorganisation
chore: clean up config, decorators, and dev tooling

gatehouse_app/api/oidc.py

@@ -21,7 +21,7 @@ from gatehouse_app.extensions import db
 from gatehouse_app.extensions import bcrypt as flask_bcrypt
 from gatehouse_app.extensions import redis_client as _redis_client_ref  # may be None until app init
 from gatehouse_app.models import User, OIDCClient
-from gatehouse_app.models.organization import Organization
+from gatehouse_app.models.organization.organization import Organization
 from gatehouse_app.exceptions.auth_exceptions import InvalidCredentialsError
 
 # ---------------------------------------------------------------------------
@@ -326,7 +326,7 @@ def oidc_complete():
         400: invalid request
         401: invalid token
     """
-    from gatehouse_app.models.session import Session as GHSession
+    from gatehouse_app.models.user.session import Session as GHSession
     from gatehouse_app.utils.constants import SessionStatus
 
     data = request.get_json(silent=True) or {}