fix: auto-derive org domains from member emails; keep domain validation on backend

api/handlers.go

@@ -1299,8 +1299,11 @@ func (h *Handlers) CreateOrg(w http.ResponseWriter, r *http.Request) {
 		ErrorResponse(w, http.StatusBadRequest, "missing_fields", "Organization name required")
 		return
 	}
-	// Domains are optional — used for invite validation only
-	// Validate domains are not empty strings (if provided)
+	if len(req.Domains) == 0 {
+		ErrorResponse(w, http.StatusBadRequest, "missing_fields", "At least one domain required")
+		return
+	}
+	// Validate domains are not empty strings
 	for _, d := range req.Domains {
 		if strings.TrimSpace(d) == "" {
 			ErrorResponse(w, http.StatusBadRequest, "invalid_domains", "Empty domain not allowed")

portal/templates/app/project.html

@@ -1057,8 +1057,11 @@
       try {
         let orgId = existingOrgId;
         if (!orgId) {
-          // Create new global org first
-          const createRes = await fetchAPI('/api/orgs', { method: 'POST', body: JSON.stringify({ name, domains: [], role, website: '' }) });
+          // Auto-derive domains from member emails
+          const emailDomains = [...new Set(
+            members.map(m => m.email ? m.email.split('@')[1] : null).filter(Boolean)
+          )];
+          const createRes = await fetchAPI('/api/orgs', { method: 'POST', body: JSON.stringify({ name, domains: emailDomains, role, website: '' }) });
           if (!createRes.ok) { const e = await createRes.json(); throw new Error(e.error || 'Failed to create org'); }
           const created = await createRes.json();
           orgId = created.entry_id || created.org_id;