feat: dashboard route gated on canSeeOrgAdmin

Relax the dashboard route from canSeeAdmin (strict platform admin)
to canSeeOrgAdmin so the access seam can widen the audience past
the platform admin — by default platform admin, plus whatever an
access extension chooses to admit. The dashboard endpoint takes
care of scoping the response per caller.

Also move Dashboard under the canSeeOrgAdmin bullet in the
access.ts predicate notes.

config/routes.ts

@@ -9,7 +9,10 @@ const baseRoutes = [
     icon: 'icon-dashboard',
     selectedIcon: 'icon-dashboard-filled',
     defaultIcon: 'icon-dashboard',
-    access: 'canSeeAdmin',
+    // `canSeeOrgAdmin` widens to anyone the access seam grants
+    // admin-ish visibility — by default platform admin, plus
+    // whatever the routes extension chooses to allow.
+    access: 'canSeeOrgAdmin',
     component: './dashboard',
     routes: []
   },