fix: filter deactivated members from activity query and clamp inactiveDays

- Add deactivated:false to members query in getOrgActivity so deactivated
  users don't inflate lastSession or get picked as owner
- Clamp inactiveDays to non-negative to prevent future-dated cutoffs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: claudfuen

apps/api/src/admin-organizations/admin-organizations.controller.ts

@@ -57,7 +57,7 @@ export class AdminOrganizationsController {
     @Query('limit') limit?: string,
   ) {
     return this.service.getOrgActivity({
-      inactiveDays: Number.isFinite(parseInt(inactiveDays ?? '90', 10)) ? parseInt(inactiveDays ?? '90', 10) : 90,
+      inactiveDays: Math.max(0, Number.isFinite(parseInt(inactiveDays ?? '90', 10)) ? parseInt(inactiveDays ?? '90', 10) : 90),
       hasAccess: hasAccess === 'true' ? true : hasAccess === 'false' ? false : undefined,
       onboarded: onboarded === 'true' ? true : onboarded === 'false' ? false : undefined,
       page: Math.max(1, parseInt(page || '1', 10) || 1),

apps/api/src/admin-organizations/admin-organizations.service.ts

@@ -127,6 +127,7 @@ export class AdminOrganizationsService {
           onboardingCompleted: true,
           _count: { select: { members: true, tasks: true, policies: true, auditLog: true } },
           members: {
+            where: { deactivated: false },
             select: {
               role: true,
               user: {