Fix broadcast delivery; make transit organisations manageable

Broadcasts never reached anyone. The internal FCM call defaulted to
127.0.0.1, which inside the php container is the php container itself — the
web server runs in a separate nginx container, reachable by service name on
the Compose network. Every send failed the curl and returned a generic 502.
The default now points at nginx, the URL is overridable via FCM_INTERNAL_URL,
and the error carries the actual reason and target instead of a bare status.

Transit organisations were a read-only count table with nothing to act on.
The module now supports the operations an admin actually needs:
- open an organisation for its counts, routes, recent trips and admins
- create one, including the founding administrator create.php requires
- edit city, contact details, contract status and trial end, with a
  confirmation when the contract changes since suspending cuts off service
- add an administrator, and enable or disable an existing one

Verified end to end against the endpoints' real payload shapes, including
that an incomplete create form is rejected before any request is sent.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dashboard/siro-admin/index.html

@@ -15,7 +15,7 @@
   <!-- ?v= must be bumped whenever css/main.css or js/app.js changes: the files
        are served straight off a bind mount, so without it browsers keep
        running the previously cached build after a deploy. -->
-  <link rel="stylesheet" href="css/main.css?v=2026-07-25-8">
+  <link rel="stylesheet" href="css/main.css?v=2026-07-25-9">
 </head>
 <body>
 
@@ -609,6 +609,6 @@
     </div>
   </div>
 
-  <script src="js/app.js?v=2026-07-25-8"></script>
+  <script src="js/app.js?v=2026-07-25-9"></script>
 </body>
 </html>