Advertise the auto confirm feature flag to the clients

Web vaults up to 2026.4.x do not show the automatic user confirmation policy
based on the organization flag alone, they additionally require the server side
feature flag `pm-19934-auto-confirm-organization-users`:

    display$(org, config) =>
        config.getFeatureFlag$(FeatureFlag.AutoConfirm)
              .pipe(map(f => f && org.useAutomaticUserConfirmation))

Without it the policy is simply missing from Settings -> Policies. Newer clients
dropped the flag again and look at `useAutomaticUserConfirmation` alone, so
sending it stays harmless there. It follows `ORG_AUTO_CONFIRM_ENABLED`, which
keeps it off unless the server really supports the feature.

src/api/core/mod.rs

@@ -220,6 +220,10 @@ fn config() -> Json<Value> {
         &FeatureFlagFilter::ValidOnly,
     );
     feature_states.insert("pm-19148-innovation-archive".to_owned(), true);
+    // Web vaults up to 2026.4.x only offer the automatic user confirmation policy when this flag is on:
+    // `display$(org, config) => config.getFeatureFlag$(FeatureFlag.AutoConfirm).pipe(map(f => f && org.useAutomaticUserConfirmation))`
+    // Newer clients dropped the flag and look at `useAutomaticUserConfirmation` alone, so sending it stays harmless.
+    feature_states.insert("pm-19934-auto-confirm-organization-users".to_owned(), CONFIG.org_auto_confirm_enabled());
 
     Json(json!({
         // Note: The clients use this version to handle backwards compatibility concerns