Rename user archive action to deactivate

"Archive" was misleading for users: the action sets a profile to
DEACTIVATED while keeping the person in the organization. Rename it to
"deactivate" across the API, CLI, MCP, n8n, and console UI.

Consolidate the two overlapping operations into a single deactivateUser
backed by the fuller, guarded logic (SCIM guard, last-active-owner
guard, invitation expiry, signature cancellation, membership update,
webhook) and authorized via iam:membership-profile:deactivate. Remove
the archiveUser surface and the thin state-only deactivate path.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -2994,26 +2994,26 @@ func (r *Resolver) RemoveUserTool(ctx context.Context, req *mcp.CallToolRequest,
 	return nil, types.RemoveUserOutput{DeletedUserID: input.ProfileID}, nil
 }
 
-func (r *Resolver) ArchiveUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.ArchiveUserInput) (*mcp.CallToolResult, types.ArchiveUserOutput, error) {
-	scope, err := r.Authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDelete)
+func (r *Resolver) DeactivateUserTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeactivateUserInput) (*mcp.CallToolResult, types.DeactivateUserOutput, error) {
+	scope, err := r.Authorize(ctx, input.ProfileID, iam.ActionMembershipProfileDeactivate)
 	if err != nil {
-		return nil, types.ArchiveUserOutput{}, err
+		return nil, types.DeactivateUserOutput{}, err
 	}
 
-	err = r.iamSvc.OrganizationService.ArchiveUser(ctx, scope, input.OrganizationID, input.ProfileID)
+	err = r.iamSvc.OrganizationService.DeactivateUser(ctx, scope, input.OrganizationID, input.ProfileID)
 	if err != nil {
 		if _, ok := errors.AsType[*iam.ErrUserManagedBySCIM](err); ok {
-			return nil, types.ArchiveUserOutput{}, fmt.Errorf("user is managed by SCIM and cannot be archived: %w", err)
+			return nil, types.DeactivateUserOutput{}, fmt.Errorf("user is managed by SCIM and cannot be deactivated: %w", err)
 		}
 
 		if _, ok := errors.AsType[*iam.ErrLastActiveOwner](err); ok {
-			return nil, types.ArchiveUserOutput{}, fmt.Errorf("cannot archive last active owner: %w", err)
+			return nil, types.DeactivateUserOutput{}, fmt.Errorf("cannot deactivate last active owner: %w", err)
 		}
 
-		return nil, types.ArchiveUserOutput{}, fmt.Errorf("archive user: %w", err)
+		return nil, types.DeactivateUserOutput{}, fmt.Errorf("deactivate user: %w", err)
 	}
 
-	return nil, types.ArchiveUserOutput{ArchivedUserID: input.ProfileID}, nil
+	return nil, types.DeactivateUserOutput{DeactivatedUserID: input.ProfileID}, nil
 }
 
 func (r *Resolver) DeleteDataProtectionImpactAssessmentTool(ctx context.Context, req *mcp.CallToolRequest, input *types.DeleteDataProtectionImpactAssessmentInput) (*mcp.CallToolResult, types.DeleteDataProtectionImpactAssessmentOutput, error) {

pkg/server/api/mcp/v1/specification.yaml

@@ -1698,7 +1698,7 @@ components:
           $ref: "#/components/schemas/GID"
           description: Deleted user (profile) ID
 
-    ArchiveUserInput:
+    DeactivateUserInput:
       type: object
       required:
         - organization_id
@@ -1709,16 +1709,16 @@ components:
           description: Organization ID
         profile_id:
           $ref: "#/components/schemas/GID"
-          description: User (profile) ID to archive
+          description: User (profile) ID to deactivate
 
-    ArchiveUserOutput:
+    DeactivateUserOutput:
       type: object
       required:
-        - archived_user_id
+        - deactivated_user_id
       properties:
-        archived_user_id:
+        deactivated_user_id:
           $ref: "#/components/schemas/GID"
-          description: Archived user (profile) ID
+          description: Deactivated user (profile) ID
 
     GetProfileInput:
       type: object
@@ -12679,14 +12679,14 @@ tools:
       $ref: "#/components/schemas/RemoveUserInput"
     outputSchema:
       $ref: "#/components/schemas/RemoveUserOutput"
-  - name: archiveUser
-    description: Archive a user in the organization
+  - name: deactivateUser
+    description: Deactivate a user in the organization
     hints:
       readonly: false
     inputSchema:
-      $ref: "#/components/schemas/ArchiveUserInput"
+      $ref: "#/components/schemas/DeactivateUserInput"
     outputSchema:
-      $ref: "#/components/schemas/ArchiveUserOutput"
+      $ref: "#/components/schemas/DeactivateUserOutput"
   - name: addThirdParty
     description: Add a new thirdParty to the organization
     hints: