Make profile state filters multi-value

Address PR review feedback on the profile-state split: SAML sign-in now
activates a pending profile, deactivation counts owners against the
profile's own organization to close a last-owner bypass, the migration
leaves historical activated_at/deactivated_at NULL rather than
fabricating timestamps, and pending members are no longer rendered with
the deactivated (faded) styling.

Drop the single-value state filter in favor of the multi-value states
across the profile and signatory surfaces. Remove ProfileFilter.state
(only states[] remains) and convert the signatures profileState filter
to profileStates. Turn the console people filter, the CLI
"user list --state" flag, and the n8n listUsers and getAllSignatures
state inputs into multi-select controls, where an empty selection means
all states.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/iam/organization_service.go

@@ -405,7 +405,7 @@ func (s *OrganizationService) DeactivateUser(
 			if membership.Role == coredata.MembershipRoleOwner && profile.State == coredata.ProfileStateActive {
 				profiles := coredata.MembershipProfiles{}
 
-				count, err := profiles.CountActiveOwnerByOrganizationID(ctx, tx, scope, organizationID)
+				count, err := profiles.CountActiveOwnerByOrganizationID(ctx, tx, scope, profile.OrganizationID)
 				if err != nil {
 					return fmt.Errorf("cannot count active owners: %w", err)
 				}

pkg/iam/saml/service.go

@@ -336,6 +336,10 @@ func (s *Service) HandleAssertion(
 				if profile.State == coredata.ProfileStateDeactivated {
 					return NewUserInactiveError(profile.ID)
 				}
+
+				if profile.State == coredata.ProfileStatePending {
+					profile.MarkActive(now)
+				}
 			}
 
 			if err := membership.LoadByIdentityIDAndOrganizationID(