Add active status field to access entries

Track whether an account is active (enabled) or disabled at the
source system. The field is nullable so existing entries without
this data remain valid.

- DB migration adds active BOOLEAN column to access_entries
- Coredata read/write/upsert/filter wiring for the new column
- Review engine propagates Active from source accounts
- GraphQL schema exposes active on AccessEntry and AccessEntryFilter
- MCP spec, types, and resolvers expose active and fix missing
  account_type filter that was wired in GraphQL but not MCP
- CLI list command adds --active filter flag and ACTIVE output column
- Console campaign detail table shows Active/Disabled status badge
- E2e and unit tests updated to cover the new field

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/mcp/v1/schema.resolvers.go

@@ -3438,7 +3438,9 @@ func (r *Resolver) ListAccessEntriesTool(ctx context.Context, req *mcp.CallToolR
 			Flag:           input.Filter.Flag,
 			IncrementalTag: input.Filter.IncrementalTag,
 			IsAdmin:        input.Filter.IsAdmin,
+			Active:         input.Filter.Active,
 			AuthMethod:     input.Filter.AuthMethod,
+			AccountType:    input.Filter.AccountType,
 		}
 	}
 

pkg/server/api/mcp/v1/specification.yaml

@@ -7721,6 +7721,11 @@ components:
         is_admin:
           type: boolean
           description: Whether the user has admin privileges
+        active:
+          type:
+            - boolean
+            - "null"
+          description: Whether the account is active at the source (null when unknown)
         mfa_status:
           $ref: "#/components/schemas/MFAStatus"
           description: MFA status
@@ -7879,6 +7884,9 @@ components:
             is_admin:
               type: boolean
               description: Filter by admin status
+            active:
+              type: boolean
+              description: Filter by active status at the source
             auth_method:
               $ref: "#/components/schemas/AccessEntryAuthMethod"
               description: Filter by auth method
@@ -13277,7 +13285,7 @@ tools:
     outputSchema:
       $ref: "#/components/schemas/ListAccessReviewCampaignsOutput"
   - name: listAccessEntries
-    description: List access entries for a campaign with optional filters (decision, flag, incremental_tag, is_admin, auth_method, account_type)
+    description: List access entries for a campaign with optional filters (decision, flag, incremental_tag, is_admin, active, auth_method, account_type)
     hints:
       readonly: true
       idempotent: true

pkg/server/api/mcp/v1/types/access_review.go

@@ -77,6 +77,7 @@ func NewAccessEntry(e *coredata.AccessEntry) *AccessEntry {
 		Role:             e.Role,
 		JobTitle:         e.JobTitle,
 		IsAdmin:          e.IsAdmin,
+		Active:           e.Active,
 		MfaStatus:        e.MFAStatus,
 		AuthMethod:       e.AuthMethod,
 		AccountType:      e.AccountType,