Add user activate and deactivate operations

[gearnode]

Add CLI (prb user activate / deactivate) and n8n operations for toggling membership profile state. Connect API exposes the corresponding mutations and the console person page lets owners activate or deactivate users. The IAM service now guards against deactivating the last active owner, skips no-op transitions, rejects SCIM-managed profiles, and emits a UserUpdated webhook.

---

Summary by cubic

Add activate/deactivate for organization users across Console, Connect API, prb CLI, and packages/n8n-node. Adds guardrails in IAM and emits a UserUpdated webhook.

• New Features

  • Connect API: activateUser and deactivateUser mutations return profile { id state }; permission checks; no-ops skipped; rejects SCIM-managed profiles; blocks deactivating the last active owner; emits UserUpdated.
  • Console: Person page and People list now show Activate/Deactivate actions with confirms, toasts, and permission/SCIM gating.
  • CLI: prb user activate <profileId> [--org] and prb user deactivate <profileId> [--org] with optional --output json.
  • n8n: new activateUser and deactivateUser actions under the user resource.
  • Tests: e2e coverage for activate/deactivate, no-op, forbidden access, and last-active-owner protection.

• Migration

  • Connect API breaking change: DeactivateUserPayload now returns profile instead of success. Update clients to request profile { id state }.

^{Written for commit 374095d. Summary will update on new commits. Review in cubic}