fix(org,team): guard the owner team rename, show permission-only team access and tidy member lookups

Signed-off-by: bircni <bircni@icloud.com>

internal/services/organizations.go

@@ -163,7 +163,7 @@ func (s Organizations) Create(ctx context.Context, opts OrganizationOptions) (Or
 		})
 	})
 	if err != nil {
-		return Organization{}, Classify(err, "organization", "", "")
+		return Organization{}, Classify(err, "name", strconv.Quote(deref(opts.Name)), "")
 	}
 	return organizationFrom(org), nil
 }
@@ -285,7 +285,15 @@ func (s Organizations) IsPublicMember(ctx context.Context, name, username string
 // check runs a membership check that answers no with a 404.
 func (s Organizations) check(ctx context.Context, op func(context.Context, *gitea.Client) (*gitea.Response, error)) (bool, error) {
 	err := do(ctx, s.Client, op)
+	// Gitea redirects callers who are not members, and tea does not follow the redirect.
+	if failure, ok := errors.AsType[*transport.APIError](err); ok && failure.Status == http.StatusSeeOther {
+		return false, &transport.APIError{Status: http.StatusForbidden, Method: failure.Method, Endpoint: failure.Endpoint, Message: "only organization members can check memberships"}
+	}
 	if IsNotFound(err) {
+		// A mistyped user is not a missing membership.
+		if missing, ok := errors.AsType[*NotFoundError](Classify(err, "", "", "")); ok && missing.Kind == "user" {
+			return false, missing
+		}
 		return false, nil
 	}
 	return err == nil, err