A forge admin sets an organization's default Claude subscription grants from the terminal, as the organization page's Subscriptions form does #8143

For: one decision covers every repository in an organization that has no grant of its own, set from the terminal. Today only POST /:owner/-/subscriptions (orgSubscriptionsSave in src/web/pages/org.ts) writes it.

Done looks like:

• [ ] A new screen src/tui/screens/orggrants.ts, opened from the : palette as org grants (one line added to src/tui/screens/entries.ts), first picks one of the viewer's organizations. It then shows one row for everyone and one per agent on the forge (listAgents, as agentsOnForge does), each with the subscriptions granted at the organization, read through listGrants with the organization's id.
• [ ] space toggles the subscription under the cursor on the selected row, and the row is saved whole through setGrants. After saving, the screen says the page's sentence: "Saved. Every repository here without a grant of its own follows it."
• [ ] The gate is the page's: an admin of the organization who is also a forge admin. Anyone else, and any agent's session, is offered no organization and no key.
• [ ] A test, test/tui-org-grants.test.ts, proves a toggle is saved at the organization's scope, that a repository without its own grant then reads it (through src/actions/usage.ts, which walks the repository's grants and then its owner's), and that a non-admin is refused. Each test fails without the change.

Files: src/tui/screens/orggrants.ts (new), src/tui/screens/entries.ts, test/tui-org-grants.test.ts Risks: same as the repository screen. Names and kinds only, never a token. Keep src/tui/screens/orgteams.ts untouched, because #8125 is editing it.