Add org-scoped Ai::Setting lookup behind a flag

What does this MR do and why?

Adds organization-scoped lookup for Ai::Setting, behind a feature flag:

• Ai::Setting.for_organization(organization) finds or creates the settings row for an organization.
• belongs_to :organization association (optional).
• New wip flag ai_settings_organization_scoped_lookup (default disabled).
• The Duo Workflow onboarding and composite OAuth token services read settings via for_organization when the flag is enabled, otherwise keep using Ai::Setting.instance.

With the flag disabled, behavior is identical to today.

Security::PolicySetting and WorkItems::Settings do similarly.

Dependency

Depends on !226045 (merged), which adds the organization_id column, unique index, and foreign key to ai_settings. CI here will fail until !226045 (merged) merges.

References

• Issue: #531356
• Depends on: !226045 (merged)

How to set up and validate locally

1. Ensure the !226045 (merged) migrations are applied (the organization_id column exists).
2. Enable the flag for an organization:

   Feature.enable(:ai_settings_organization_scoped_lookup, Organizations::Organization.find(1))

3. Confirm org-scoped lookup:

   Ai::Setting.for_organization(Organizations::Organization.find(1))

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.