feat(user-mgmt): user lifecycle (invite + deactivate) + activity, in Settings (#995)

[dolho]

Summary

Enterprise user lifecycle (#995) — admin invite (sends a real invite email) + deactivate/reactivate, plus a per-user activity view — integrated into the existing Settings → User Management table. Pivoted from the earlier Organizations approach (dropped — single-tenant). Backend logic lives in the private trinity-enterprise submodule (PR #2); this PR is the OSS seam.

OSS primitive (edition-agnostic)

• users.suspended_at column + migration; surfaced in get_user/list_users + /api/users.
• get_current_user rejects suspended users on both the JWT and MCP-key paths → setting the column blocks new logins and invalidates live tokens on the next request (immediate sign-out). Reversible.

Enterprise UI (gated by user_management, hidden in OSS)

• Settings → User Management gains: Invite user form, per-row Deactivate/Reactivate (never for self or the built-in admin), and a per-user Activity drawer.
• All call the private /api/enterprise/user-management/* endpoints.
• Table fits the max-w-4xl card (trimmed padding + wrapping actions) — no clipping, no horizontal scrollbar.

Removed

• The separate /enterprise/user-management Orgs page + route + store + Index card. Index card now links to Settings.

Behaviour notes

• Deactivation = reversible auth lock, not delete: the user row + all owned agents/data stay; the person just can't authenticate until reactivated. (Agents/schedules they own keep running — out of scope here.)
• Distinct from the email whitelist: whitelist is the login-time admission gate (who may log in); deactivation is per-request enforcement on an existing account (kills live sessions). Invite uses the whitelist to admit; deactivate locks an existing user.

Verification (live + unit)

• Live on a running stack: /api/users exposes suspended_at; suspend writes it + reactivate clears; guards (self/admin → 400, unknown → 404); invite → 201 and the invite email fired (console-rendered: To/Subject/body, email_sent: true); dup → 409; revoke → 204; activity → 200.
• Settings.vue compiles; OSS-only builds hide every enterprise control.

Submodule pointer not bumped here; advances after trinity-enterprise#2 merges. Related to #995, #847.

🤖 Generated with Claude Code

[dolho]

🔧 Make-it-functional notes & merge order

This PR is the OSS seam only (gated UI + the users.suspended_at primitive + enforcement + docs). The actual user-management endpoints live in trinity-enterprise#2.

Cross-PR dependency: the Settings UI calls /api/enterprise/user-management/*, which only exist once the private module is merged and the public submodule pointer is bumped. Until then the user_management entitlement never registers, so the UI stays hidden — this PR is safe to land alone (no 404s for users).

Deactivation needs both halves: this PR adds the OSS suspended_at column + the get_current_user reject (the enforcement); #2 adds the setter. Both must be deployed for "Deactivate" to actually block login.

Merge order:

1. Merge trinity-enterprise#2 (→ its main).
2. Bump this repo's submodule pointer (src/backend/enterprise) to that commit (separate public commit).
3. Merge this PR (→ dev).

Deploy prereq: the dev/prod host must be able to fetch the private submodule (the .gitmodules SSH URL needs a deploy key/PAT) — and the dev deploy is currently stalled (VM off the tailnet), tracked separately.

Docs updated in docs/memory/architecture.md (enterprise modules + suspended_at primitive).

[dolho]

/review — pre-landing review

Scope: CLEAN. Committed contents are exactly the 9 intended files (verified via gh pr diff + git log origin/dev..HEAD). The submodule pointer is not bumped here — correct, matches the documented merge order.

Critical: none

• Auth ✅ — OSS get_current_user rejects suspended users on both JWT and MCP-key paths; migration defaults suspended_at NULL so no existing session breaks on deploy; built-in admin/self can't be suspended (enforced in the enterprise service).
• SQL ✅ — suspended_at added to _USER_COLUMNS, row mapper, list_users, and the migration uses _safe_add_column (idempotent, no data loss).
• Frontend ✅ — no v-html; activity drawer renders via escaped {{ }}; all axios calls use the shared auth'd instance with catch blocks.

Informational

• [I4] Settings.vue uses native alert() for suspend/reactivate errors — functional, crude UX.
• [I5] Working-tree hazard (this branch): locally, src/backend/enterprise is checked out to the unmerged siem branch and VERSION/.claude are dirty. A future git add -A on this branch would sweep the pointer bump (to an unmerged commit) into the PR. Use explicit git add until the tree is reset.

Verdict: 0 critical — clear to merge in order (enterprise#2 → bump submodule pointer → this).

[github-actions]

⚠️ Nightly unit-suite check skipped — merge conflict against dev.

Resolve by running git merge dev locally and pushing the result. The next nightly run will re-test once the conflict is gone.

[vybe]

Validated: suspended-user rejection correct on BOTH auth paths (JWT + MCP key fall through to 401, no None leak), main.py broad-except scoped only to enterprise registration, migration idempotent via _safe_add_column, schema+migration consistent, architecture.md thoroughly updated, UI fully entitlement-gated and OSS-inert. CI 15/15 green. APPROVE.