docs: note Azure DevOps global PAT retirement + draft plan 002

[rcappello]

Two documentation-only commits related to the Azure DevOps global PAT retirement announced for 1 December 2026 (aka.ms/GlobalPATDeprecation).

1. docs: note Azure DevOps global PAT retirement (Dec 1, 2026) (572ae71)

• src/vscode/README.md + src/vs2026/README.md
  • The PAT sign-in bullet in Getting started now spells out that the PAT must have the All accessible organizations scope so _apis/accounts can enumerate every org.
  • New section PAT scope and the 1 Dec 2026 deprecation explaining:
    • why the current PAT flow needs a global PAT (call to app.vssps.visualstudio.com/_apis/accounts);
    • Microsoft's retirement date and the fact that Azure DevOps Server is unaffected;
    • the recommendation to use Sign in with Microsoft as the durable path;
    • a link to plan 002 for multi-org PAT support after the retirement.
• CHANGELOGs (root + per-client) — new [Unreleased] > Documentation entry.

2. docs(specify): draft plan 002 - PAT sign-in per-organization fallback (d1ffa4c)

New design document at .specify/plans/002-pat-per-org-fallback.md (linked from the READMEs above). Design summary:

• Keep the existing global path (_apis/profile/profiles/me + _apis/accounts) as the first attempt.
• On 200 + empty list, 401 / 403, or network / 5xx -> fall back to a per-organization flow: prompt for org name, verify with GET dev.azure.com/{org}/_apis/projects?$top=1&api-version=7.1, then persist the PAT under a per-org key (pipelinesexplorer.pat.org.{org} in VS Code SecretStorage; PipelinesExplorer/pat/{org} in Windows Credential Manager for VS 2026).
• New command Add another Azure DevOps organization... to layer multiple per-org PATs.
• Reset and Sign out wipe every per-org slot.
• Full cross-client scope, l10n keys, tests and release impact (Yes - Minor on both clients) documented.

Also updates .specify/plans/_backlog.md: plan 001 -> Done, plan 002 -> Draft.

No code changes / no version bump

Docs-only. Per the release matrix in .github/instructions/project.instructions.md, this batch lands in the [Unreleased] section of the CHANGELOGs and does not warrant a release.

Verification

• git log --oneline main..HEAD -> two commits above.
• No files under src/vscode/src/ or src/vs2026/*.cs touched -> no build required.