Part of a series (2 stacked PRs) thatclosescoder/internal#1073

• PR1/2
• PR 2/2 (this one)

Adds a per-organization setting to disable workspace sharing. When enabled,
all existing workspace ACLs in the organization are cleared and workspace
sharing API endpoints return403 Forbidden.

This complements the existing site-wide--disable-workspace-sharing flag by
providing more granular control at the organization level.

Changes

• New API endpoints for organization workspace sharing settings:
  • GET/organizations/{org}/settings/workspace-sharing
  • PATCH/organizations/{org}/settings/workspace-sharing
• CLI commands:coder organizations settings show workspace-sharing
  andcoder organizations settings set workspace-sharing
• When sharing is disabled for an organization:
  • All existing workspace ACLs are cleared (DeleteWorkspaceACLsByOrganization)
  • ACL endpoints (GET/PATCH/DELETE/workspaces/{id}/acl) return403 Forbidden
  • The org-member role is reconciled to remove sharing permissions
• Audit logging for settings changes

Implementation notes

• Consideredorganization edit --disable-workspace-sharing but chose the settings
  endpoint pattern for extensibility (e.g., future settings like default share level, allowed
  share levels)
• The setting is stored on the organizations table asworkspace_sharing_disabled
• Disabling sharing is a destructive operation that removes all existing ACL entries
• Re-enabling sharing does not restore previously cleared ACLs