feat(users): deactivate members, and make the membership the authority

[keysersoft]

First of the SCIM series. Adds the primitive that removes a person's access to a workspace in one action, an admin Deactivate / Reactivate on top of it, and fixes four pre-existing authorization defects that made such a primitive untrustworthy. Cloud-relevant: none of this is SSO-gated.

The primitive

UserLifecycleService.deactivateInOrganization closes every path at once — dashboard sessions, MCP OAuth tokens, MCP API keys, and the membership — because each is checked by different code and a leaver who keeps any one of them has not left. SCIM active: false (next PR) calls the same method, so the directory and the admin can never disagree about what "deactivated" means.

OrganizationMember.deactivatedAt marks the state. The row is kept: role and joinedAt survive reactivation, and the member list can say "Deactivated" instead of making a leaver indistinguishable from someone who was never here. Reactivation restores the membership only — revoked keys stay revoked, old sessions stay dead.

Last admin: an admin-initiated deactivation of the only active admin is refused before any write. A directory-initiated one (SCIM) revokes sessions and keys but keeps the membership, so the workspace keeps one way back in; audited as LAST_ADMIN_PROTECTION_TRIGGERED.

Defects fixed

	Before	After
PUT /api/users/:id/role	wrote users.role (the cache) only; organization_members.role untouched → a demoted admin kept unrestricted MCP tools	writes the membership, refreshes the cache, revokes sessions on demotion
Last admin	no guard on delete or demotion	shared assertNotLastAdmin (active admins only) on demotion, removal, deactivation
GET /api/users	listed from the cache column; multi-workspace members invisible	lists memberships, with active / deactivatedAt
DELETE /api/users/:id	deleted the global user row — one workspace's admin could destroy access everywhere	removes only this membership when the user belongs to other workspaces
JwtStrategy	role from cache; self-healed only a NULL org → removed/deactivated members kept working sessions	role from the active membership; repoint or 401 No active workspace

The same fail-closed rule now applies in getAllowedToolIds (no org → no tools; deactivated → no tools), the global /mcp listing, MCP API key resolution, per-server tenant checks and SSO membership checks.

Migration

Additive nullable column plus a reconcile of cache/membership role drift, run before the code treats the membership as authoritative. Production audited first: 0 of 1380 cloud users have an active org without a membership row, 0 role mismatches, 0 orphaned keys.

Verified

End to end on the local stack:

baseline  key: 4 tools | leaver JWT: 200
deactivate → key: REFUSED | old JWT: 401 | fresh JWT: 401
db: deactivated_at set, key_active=false, sessions_valid_from set, active_org=NULL
audit: USER_DEACTIVATED, SESSIONS_REVOKED, API_KEY_DEACTIVATED
reactivate → fresh JWT: 200 | old key: still REFUSED
demote ADMIN→VIEWER → membership.role=VIEWER, pre-demotion JWT: 401

Through the UI: status pill, Deactivate/Reactivate actions (both users pages), reactivation audit row. 3889 tests pass.

Behaviour changes to note in the release

• A member with no active membership is refused at JWT validation.
• GET /api/users returns memberships (multi-org members now visible); DELETE /api/users/:id removes the membership rather than the account when the user is in other workspaces.
• Deactivation revokes sessions globally (one re-login in other workspaces); keys and roles are org-scoped.