Make profile state filters multi-value

Address PR review feedback on the profile-state split: SAML sign-in now
activates a pending profile, deactivation counts owners against the
profile's own organization to close a last-owner bypass, the migration
leaves historical activated_at/deactivated_at NULL rather than
fabricating timestamps, and pending members are no longer rendered with
the deactivated (faded) styling.

Drop the single-value state filter in favor of the multi-value states
across the profile and signatory surfaces. Remove ProfileFilter.state
(only states[] remains) and convert the signatures profileState filter
to profileStates. Turn the console people filter, the CLI
"user list --state" flag, and the n8n listUsers and getAllSignatures
state inputs into multi-select controls, where an empty selection means
all states.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/server/api/mcp/v1/specification.yaml

@@ -577,9 +577,6 @@ components:
             contract_ended:
               type: boolean
               description: Filter by contract status. True returns only users with ended contracts, false returns only users with active or no contract.
-            state:
-              $ref: "#/components/schemas/ProfileState"
-              description: Filter by profile state (PENDING, ACTIVE, or DEACTIVATED)
             states:
               type: array
               items:
@@ -6421,9 +6418,11 @@ components:
             active_contract:
               type: boolean
               description: Signatory contract status
-            profile_state:
-              $ref: "#/components/schemas/ProfileState"
-              description: Signatory profile state
+            profile_states:
+              type: array
+              items:
+                $ref: "#/components/schemas/ProfileState"
+              description: Signatory profile states
 
     ListDocumentVersionSignaturesOutput:
       type: object