- product_category: org_id scoped tree, product_table_name -> product_type
- product: org_id scoped, added extra_json for custom attributes, product_type field
- product_type_config: org_id + operator_id dual isolation, unique key on (org_id, operator_id, category_id, config_name)
- All 18 API endpoints enforce org_id filtering via ServerEnv
- core.py: all methods accept optional org_id, default to current user's org
- CRUD definitions: logined_userorgid set to org_id on all lists
- init/data.json: removed hardcoded global categories (managed per reseller)
- Rebuilt mysql.ddl.sql and all CRUD UI files