list_sites MCP tool returns 401 with full access Organization API key

Describe the bug list_sites (the MCP tool backing GET /organizations) returns 401 Unauthorized when called with an Organization API key, even with full access. Other MCP tools work fine with the same key.

To Reproduce

1. Create an Organization API key (Settings > Organization > API Keys), no restrictions
2. Connect an MCP client using the key as Authorization: Bearer <key>
3. Call get_site(site_id) or get_overview(site_id), it works
4. Call list_sites, get 401 Unauthorized

Expected behavior list_sites should work for a full-access Organization API key the same way it does for a Personal API key. Org keys are the documented recommendation for integrations.

Additional context Self-hosted v2.8.0.

getMyOrganizations (backing GET /organizations) authenticates through getUserIdFromRequest, which only returns a value when the credential has a userId. Organization owned keys have organizationId instead of userId (see BearerAuthResult). So getUserIdFromRequest always returns null for an org key and the route 401s no matter what permissions the key has.