Last Owner in organization can demote themselves, causing permanent org lockout

[emimoir]

The sole owner of an organization can change their own role from Owner to Viewer (or Employee), and this results in permanent loss of all admin privileges with no warning or way to resolve it from the front end.

1. Create new organization in Probo account
2. You are the sole Owner
3. Go to People and click the role dropdown on your own membership
4. Change your role from Owner to Viewer
5. The role change is accepted without warning - now you're stuck.

Notes (thanks claude!)

• The RemoveUser path already has a guard for this at
  pkg/iam/organization_service.go:323-332 using CountActiveOwnerByOrganizationID, but
  the UpdateMembership path at line 244-292 has no equivalent check before allowing
  a role demotion from Owner.

Trying to submit only useful stuff here!

[gearnode]

Thanks for the report and for taking the time to investigate the root cause, really appreciated! Will be patched today.