fix: block merging personal workspaces with company organizations

[bokelley]

Summary

• Prevent personal workspaces from being merged with company organizations
• Add warning messages in merge preview when personal workspaces are incorrectly included
• Return 400 (validation error) instead of 500 when merge is blocked

Changes

1. server/src/db/org-merge-db.ts:

   • mergeOrganizations(): Added blocking check that throws an error if either org is a personal workspace
   • previewMerge(): Added prominent warning messages when personal workspaces are included in merge candidates

2. server/src/routes/admin/cleanup.ts:

   • Return HTTP 400 for validation errors (personal workspace merge attempts) instead of HTTP 500

Context

Personal workspaces represent individual users and should never be merged with company organizations. The upstream duplicate detection queries already filter is_personal = false, but this adds defense-in-depth to prevent merges even if:

• Data has is_personal incorrectly set
• User manually initiates a merge via direct API call
• There's another code path we haven't identified

Test plan

• Type checking passes (npm run typecheck)
• All unit tests pass (npm run test:unit)
• Manual verification: Attempting to merge a personal workspace shows warning in preview and blocks the merge

🤖 Generated with Claude Code