fix(webapp): resolve idempotency-reset residency only when the org is loaded on the env

Guards against a missing environment.organization so the reset no longer crashes, falling back to
the two-store reset in that case. The authenticated API path always loads the org, so behavior is
unchanged in production.

Author: d-cs

apps/webapp/app/v3/services/resetIdempotencyKey.server.ts

@@ -11,13 +11,18 @@ export class ResetIdempotencyKeyService extends BaseService {
     authenticatedEnv: AuthenticatedEnvironment
   ): Promise<{ id: string }> {
     // The predicate has no run id to route by. When the env mints run-ops ids its runs live on NEW,
-    // so pin the reset to NEW and skip the wrong-DB (0-row) write to the draining legacy DB.
-    const mintKind = await resolveRunIdMintKind({
-      organizationId: authenticatedEnv.organizationId,
-      id: authenticatedEnv.id,
-      orgFeatureFlags: authenticatedEnv.organization.featureFlags,
-    });
-    const residency = mintKind === "runOpsId" ? "NEW" : "LEGACY";
+    // so pin the reset to NEW and skip the wrong-DB (0-row) write to the draining legacy DB. Resolve
+    // this only when the org (and its flags) is loaded on the env — which the authenticated API path
+    // always provides; otherwise fall back to the two-store reset (correct, just not optimized).
+    let residency: "NEW" | "LEGACY" = "LEGACY";
+    if (authenticatedEnv.organization) {
+      const mintKind = await resolveRunIdMintKind({
+        organizationId: authenticatedEnv.organizationId,
+        id: authenticatedEnv.id,
+        orgFeatureFlags: authenticatedEnv.organization.featureFlags,
+      });
+      residency = mintKind === "runOpsId" ? "NEW" : "LEGACY";
+    }
 
     const { count: pgCount } = await this.runStore.clearIdempotencyKey(
       {