[JUM-908][Fix] Dashboard resolves organization ids to names

[web2solutions]

Summary

• The "My organization" card and the "Users by Organization" chart on /#/m/users/dashboard showed the raw organization UUID instead of its name.
• Extracts the relation-label resolver already used by X-Crud's grid (useXCrud) into a shared relationLabels.ts, and reuses it for the dashboard card and for loadMetrics' groupBy chart buckets.
• Falls back to the raw id when the relation can't be resolved (no list operation, RBAC refusal, network error), never an error.

Test plan

• bun run test (apps/frontend) — 314 passed, 0 failed, 3 consecutive runs
• bun run typecheck (apps/frontend) — clean
• bun run lint (apps/frontend) — 0 errors (5 pre-existing unrelated warnings)
• bun run build (apps/frontend) — clean
• bun run cli:build-templates — packaged CLI frontend seed resynced

Notes

• Found and fixed a real regression in this same change during development: loadMetrics's new groupBy-label wiring threw on non-OAS schema names and made an unguarded network call regardless of RBAC, which leaked async state across the frontend's shared bun:test process and broke 14 unrelated tests (auth/router/profile stores). Both are now guarded (relationFor never throws; the network read is skipped when the caller's role lacks the target list operation's scope).
• Also filed JUM-909 for an unrelated flaky a11y suite (CommercialPages.a11y.test.tsx) found while pushing a sibling branch — not fixed here, out of scope for this change.

🤖 Generated with Claude Code

---

Note

Low Risk
Display-layer changes with defensive RBAC and empty-map fallbacks; no auth or persistence logic changes beyond reusing existing list operations for labels.

Overview
Dashboard and charts now show human-readable names for x-relation foreign keys instead of raw IDs (JUM-908).

A shared relationLabels module centralizes resolving FK values via the target entity’s list operation (Cana offline or API), with RBAC checks before network reads and safe fallbacks to the raw id when resolution fails. X-Crud’s inline FK labeling is replaced by this helper; dashboard metrics groupBy on relation fields attach optional label on buckets; ChartCard renders label ?? key; and the “My organization” card resolves the profile’s organization id to its display name.

MetricsBucket gains an optional label field, with a unit test for offline groupBy labeling. CLI init templates are resynced to match.

^{Reviewed by Cursor Bugbot for commit b4da171. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_00835204-de49-4053-84d3-d68b356cb5fd)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_ed424228-69a2-4bf9-a23c-659a2a21ef34)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_c6d1b9ea-d763-45a9-9e9f-83673f8f7aa0)