Hardcoded tenant allowlists

[julietshen]

There are still functions that gate feature availability on a hardcoded set of org / queue / type IDs. Self-hosted deployments will never have these IDs, so the feature silently behaves differently for them.

P0.1 server/services/signalsService/SignalsService.ts:387-396

isSignalEnabledForOrg allowlists two Cove-era org IDs (e7c89ce7729 "Local Test Example", 53d45130ba1 "Prod ML Test") for the AGGREGATION signal type. Anyone else calling SignalsService.getSignalsForOrg (line 189) gets AGGREGATION silently filtered out. Self-hosted deployments cannot enable this signal type without source changes.

  if (signalId.type === 'AGGREGATION') {
    return [
      'e7c89ce7729' /* Local Test Example */,
      '53d45130ba1' /* Prod ML Test */,
    ].includes(orgId);
  }
  return true;
}

Fix shape: drop the gate entirely (release AGGREGATION generally), or convert to an org-settings flag / feature-flag table.

P0.2 server/services/ncmecService/ncmecReporting.ts:1182

const testOrgs = ['4def6a77d6a', 'acc701627cb']; followed by if (testOrgs.includes(reportParams.orgId)) return 'UNSUPPORTED_ORG';. Comment confirms these were Cove demo accounts that should "click Send to NCMEC" but produce no real report. New deployments will never hit this branch, but the dead allowlist is the same shape as the #474 bug.

Fix shape: delete (these orgs no longer exist in the new repo), or replace with a per-org ncmec_dry_run flag in ncmec_org_settings.

P0.3 [server/services/ncmecService/ncmecReporting.ts:1898]

(https://github.com/roostorg/coop/blob/main/server/services/ncmecService/ncmecReporting.ts#L1898)

thread.threadTypeId === 'c01a3f28dfa' switches NCMEC additionalInfo wording between "private message conversation" and "group message conversation". Deployments with any other thread type ID always get the "group" wording.

Fix shape: make this a property on the item type (e.g. schemaFieldRoles could expose a conversationKind: 'private' | 'group'), or surface as a free-text "default additional info" in NCMEC org settings.