feat(access): keep a single owner per organization

The person who registered stays the only owner. Full day-to-day access is granted through the manager role instead of a second owner.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/memberships/memberships.service.ts

@@ -1,4 +1,5 @@
 import {
+  BadRequestException,
   ForbiddenException,
   Injectable,
   NotFoundException,
@@ -70,6 +71,16 @@ export class MembershipsService {
     }));
   }
 
+  /** هر محیط یک مالک فعال دارد: همان کسی که محیط را ثبت کرده. */
+  async assertSoleOwner(organizationId: string, userId: string) {
+    const others = await this.countActiveOwners(organizationId, userId);
+    if (others > 0) {
+      throw new BadRequestException(
+        'هر محیط فقط یک مالک دارد و مالک همان کسی است که ثبت‌نام کرده. برای دسترسی کامل نقش مدیر را انتخاب کنید.',
+      );
+    }
+  }
+
   async createMembership(data: {
     userId: string;
     organizationId: string;
@@ -78,6 +89,9 @@ export class MembershipsService {
     commissionPercent?: number;
     isActive?: boolean;
   }) {
+    if (data.role === 'owner' && data.isActive !== false) {
+      await this.assertSoleOwner(data.organizationId, data.userId);
+    }
     return this.prisma.membership.create({
       data: {
         userId: data.userId,