Split inactive profile state

Replace the binary profile ACTIVE/INACTIVE model with PENDING, ACTIVE,
and DEACTIVATED so invited-but-not-yet-activated members remain
assignable to assets, data, and risks instead of being treated like
deactivated users.

Add activated_at/deactivated_at timestamps and Mark* lifecycle helpers,
and update every transition (create, invite/re-invite, activation,
archive, SCIM, SAML, sessions, compliance-portal grant) to the new
states. Expose a multi-state states[] filter across coredata, GraphQL,
MCP, and the console owner pickers, which now request ACTIVE and
PENDING members.

A migration renames the membership_state enum, classifies existing
inactive profiles as PENDING from recent invitation activity, and
backfills the new timestamp columns.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/coredata/migrations/20260728T143246Z.sql

@@ -0,0 +1,55 @@
+-- Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+--
+-- Permission to use, copy, modify, and/or distribute this software for any
+-- purpose with or without fee is hereby granted, provided that the above
+-- copyright notice and this permission notice appear in all copies.
+--
+-- THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+-- REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+-- AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+-- INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+-- LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+-- OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+-- PERFORMANCE OF THIS SOFTWARE.
+
+ALTER TABLE iam_membership_profiles
+    ADD COLUMN activated_at TIMESTAMP WITH TIME ZONE,
+    ADD COLUMN deactivated_at TIMESTAMP WITH TIME ZONE;
+
+ALTER TABLE iam_membership_profiles
+    ALTER COLUMN state DROP DEFAULT;
+
+ALTER TYPE membership_state RENAME TO membership_state_old;
+CREATE TYPE membership_state AS ENUM ('PENDING', 'ACTIVE', 'DEACTIVATED');
+
+ALTER TABLE iam_membership_profiles
+    ALTER COLUMN state TYPE membership_state
+    USING CASE
+        WHEN state::text = 'ACTIVE' THEN 'ACTIVE'::membership_state
+        ELSE 'DEACTIVATED'::membership_state
+    END;
+
+DROP TYPE membership_state_old;
+
+UPDATE iam_membership_profiles
+SET state = 'PENDING'
+WHERE state = 'DEACTIVATED'
+  AND source != 'SCIM'
+  AND EXISTS (
+      SELECT 1
+      FROM iam_invitations i
+      WHERE i.user_id = iam_membership_profiles.id
+        AND i.accepted_at IS NULL
+        AND (
+            i.expires_at >= NOW()
+            OR i.created_at >= NOW() - INTERVAL '7 days'
+        )
+  );
+
+UPDATE iam_membership_profiles
+SET activated_at = updated_at
+WHERE state = 'ACTIVE';
+
+UPDATE iam_membership_profiles
+SET deactivated_at = NOW()
+WHERE state = 'DEACTIVATED';