Make virtual org departments filter-aware + tighten the model

[etiennechabert]

Summary

Stacks on top of #282. The cost table already showed virtual departments as rolled-up rows when grouping by owner, but clicking a department to filter by it sent WHERE owner='Engineering' literally and returned zero rows — display and filter layers disagreed on what a virtual node meant. This closes the asymmetry and tightens the model.

What changes

• Validator enforces a single virtual root. Multi-root configs are wrapped under a synthetic "Organization" on load; empty trees get the same synthetic root. Non-virtual nodes with children are auto-promoted to virtual, eliminating the confusing "leaf-and-parent at the same time" edge case. The editor surfaces all three migrations as a dismissible banner.
• New expandOrgFilters core helper expands virtual-department filter values to their descendant leaves. Wired through setupQuery so every query handler (costs, trends, daily-costs, missing-tags, entity-detail) plus the explorer and filter-values handlers get it.
• query:filter-values synthesizes virtual entries with rolled-up costs (isVirtual: true). The owner-dim LIMIT 100 is dropped since cardinality is bounded by team count. When a virtual department is picked, the dropdown shows only that node + its immediate children for drill-down.
• Entity detail handles virtual entities by expanding to descendant leaves before applying the entity filter.
• Filter bar renders virtual entries with a Folder icon + "department" badge — same visual language used in the cost table.
• applyOrgTreeRollup rolls up at the root's children (departments) rather than at the root itself, so the cost table shows per-department rows instead of one big "Organization" row. rollupRealNode and the dead orgNodeValues query param are deleted.
• Cost-scope autocomplete strips virtual entries (exclusion rules apply to literal CUR values, so virtual names would be misleading).
• Inherited bug fix from Org Tree Visual Editor with Drag-and-Drop #282: the editor was passing ownerDimension.tagName (raw user_sb_team) instead of the column ID (tag_user_sb_team) to getFilterValues, which made the SQL reference a non-existent column. Now using the canonical getDimensionId helper.

20 new tests on the rollup, validator migrations, and filter expansion. All existing tests still pass.