feat(access): keep a single owner per organization

The person who registered stays the only owner. Full day-to-day access is granted through the manager role instead of a second owner.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/platform/platform.service.ts

@@ -543,6 +543,9 @@ export class PlatformService {
     });
     if (!row) throw new NotFoundException('عضویت پیدا نشد');
     if (isActive && !row.isActive) {
+      if (row.role === 'owner') {
+        await this.memberships.assertSoleOwner(row.organizationId, row.userId);
+      }
       await this.billing.assertSeatAvailable(row.organizationId, row.userId);
     }
     if (!isActive && row.role === 'owner') {
@@ -573,6 +576,9 @@ export class PlatformService {
     });
     if (!row) throw new NotFoundException('عضویت پیدا نشد');
 
+    if (role === 'owner' && row.role !== 'owner') {
+      await this.memberships.assertSoleOwner(row.organizationId, row.userId);
+    }
     if (row.role === 'owner' && role !== 'owner') {
       const owners = await this.memberships.countActiveOwners(
         row.organizationId,
@@ -580,7 +586,7 @@ export class PlatformService {
       );
       if (owners < 1) {
         throw new BadRequestException(
-          'حداقل یک مالک برای سازمان لازم است؛ ابتدا مالک دیگری تعیین کنید',
+          'مالک محیط همان کسی است که ثبت‌نام کرده و نمی‌توان نقش او را عوض کرد',
         );
       }
     }