Add invitingOrganizations field on viewer

Expose viewer.invitingOrganizations: [Organization!]! returning the
organizations that have a live pending invitation directed at the
current identity (accepted_at IS NULL AND expires_at > NOW()). The
list is rendered under a "Pending invitations" section on the
memberships page and in the organization selector dropdown, so a user
already signed in with an existing identity can see which
organizations have invited them without having to dig through their
inbox.

The new field is gated by iam:invitation:list against the viewer's
own identity, so it does not loosen authorization on Organization
elsewhere. E2E coverage validates the live-pending case, the
no-invitation and post-accept cases, and a multi-org scenario.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

pkg/server/api/connect/v1/graphql/identity.graphql

@@ -30,6 +30,10 @@ type Identity implements Node {
     before: CursorKey
   ): PersonalAPIKeyConnection @goField(forceResolver: true)
 
+  invitingOrganizations: [Organization!]!
+    @goField(forceResolver: true)
+    @session(required: PRESENT)
+
   ssoLoginURL: String
     @goField(forceResolver: true)
     @session(required: PRESENT)