Update GraphQL, MCP, and CLI for the portal

Rewire the console and visitor resolvers onto the management and visitor
services with compliance-portal authorization. Rename the GraphQL and MCP
ComplianceExternalURL type to ComplianceCustomLink, expose trust center
profile fields, default and custom domains, public URL, and the managed
flag, and drop the profile fields from the organization surface.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/console/v1/graphql/organization.graphql

@@ -93,10 +93,6 @@ type Organization implements Node {
     logo: File @goField(forceResolver: true)
     horizontalLogo: File @goField(forceResolver: true)
 
-    description: String
-    websiteUrl: String
-    email: String
-    headquarterAddress: String
     context: OrganizationContext @goField(forceResolver: true)
 
     profiles(
@@ -319,7 +315,6 @@ type Organization implements Node {
     ): AgentRunConnection! @goField(forceResolver: true)
 
     trustCenter: TrustCenter @goField(forceResolver: true)
-    customDomain: CustomDomain @goField(forceResolver: true)
     trustCenterFiles(
         first: Int
         after: CursorKey