Return a conflict when membership role updates would demote the final active owner in an organization. Add an end-to-end regression that verifies the mutation fails and leaves the owner role intact. Signed-off-by: Cursor Agent <cursoragent@cursor.com>