DAM org guidance not delivered when membership lacks WorkOS user ID

Problem

When a user is added to a DAM org by email only (no user_id), the org guidance (CLAUDE.md) is never delivered to them when they log into CalUI.

The DAM worker's membership lookup query matches on user_id or LOWER(email), but the org-noggin fetch endpoint requires a valid user ID from the auth token. If the membership row has no user_id, the match depends entirely on the email comparison — which may fail if the user logs in with a different email than the one used for add-member.

Even when email matches, the user_id column being NULL means downstream logic may not associate the membership correctly.

Reproduction

1. calc dam add-member --org <org> --user <email> (email-only, no WorkOS user ID)
2. User logs into CalUI with that email
3. Org guidance is not loaded

Expected

Org guidance should be delivered regardless of whether the membership was created with a user ID or email.

Possible Fixes

• Backfill user_id on membership rows when a user with a matching email authenticates
• Require user_id at add-member time (reject email-only if no WorkOS account exists)
• Ensure the org-noggin lookup query matches on both user_id and email reliably

Related

• DAM worker membership query: infra/cal-dam-worker/src/index.js (~line 199)
• CalUI org noggin fetch: calui/src/auth/org_noggin.rs