The organization reads name their Server-Timing phases: an org, its teams, a team's members, the caller's orgs #4983

Done: GET /api/v1/orgs/:org, /orgs/:org/teams, /orgs/:org/teams/:team/members and /user/orgs answer a Server-Timing header naming session, the read (org, teams, members, orgs), render, in that order, the way GET …/tags does (notePhase(ctx.request, "session", takeSessionTime(ctx.request)), then timePhase/timePhaseAsync around the read and around json(…)). The bodies, status codes and access rules do not change.

• [ ] Each route above names its phases; a refused read (404/403) still names session.
• [ ] One test per route asserts the header's phase names in order (pattern: test/crew-timing.test.ts), and fails without the change.
• [ ] bun test for the touched files passes.

Files: src/http/api.ts, one new test file. Risk: none to behaviour; keep the read inside the phase, not the access check.

Parked by the crew: the check failed ("a sleeping preview woken at the limit > stays asleep, and the page a visitor sees says why") and the decider saw no point in another try (pull #4994 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.