subjects
Create an organization below the caller scope
Requires `Idempotency-Key`. `kind` may be omitted from the body; the gateway then reads it as `organization`, the only kind slice 0 creates. The new subject path is `parentPath` (default: the caller scope path) plus `slug`; a parent outside the caller scope is refused.
Read one subject
A subject that does not exist and one outside the caller scope get the same 404.