fix(auth): allow POST method for organisation-specific access checks

[james-cross]

Summary

• Adds POST to the HTTP methods checked in requireOrganisationAccess middleware
• Fixes 403 Forbidden error when CityAdmins or OrgAdmins use the "Information verified" button on organisation pages

Problem

The confirm-info endpoint uses POST with an organisation ID, but the middleware only checked GET, PUT, PATCH, and DELETE for organisation-specific access. This caused POST requests to fall through to the generic handler which expected AssociatedLocationIds in the request body.

Test plan

• Log in as a CityAdmin user
• Navigate to an organisation in their assigned location
• Click "Information verified" button
• Verify the action succeeds without a 403 error