Prevent last owner from demoting themselves

The UpdateMembership path allowed the sole owner of an
organization to change their role to a non-owner role,
causing permanent lockout. Add the same active-owner count
guard already used in RemoveUser.

Closes #1071

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/iam/organization_service.go

@@ -266,6 +266,18 @@ func (s *OrganizationService) UpdateMempership(
 				return NewMembershipNotFoundError(membership.ID)
 			}
 
+			if membership.Role == coredata.MembershipRoleOwner && role != coredata.MembershipRoleOwner {
+				profiles := coredata.MembershipProfiles{}
+				count, err := profiles.CountActiveOwnerByOrganizationID(ctx, tx, scope, organizationID)
+				if err != nil {
+					return fmt.Errorf("cannot count active owners: %w", err)
+				}
+
+				if count <= 1 {
+					return NewLastActiveOwnerError(membershipID)
+				}
+			}
+
 			membership.Role = role
 			membership.UpdatedAt = time.Now()