feat(access): keep a single owner per organization

The person who registered stays the only owner. Full day-to-day access is granted through the manager role instead of a second owner.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/views/adm/AdmUsersView.vue

@@ -247,7 +247,8 @@ onMounted(() => {
               <div class="member-actions">
                 <select
                   :value="mem.role"
-                  :disabled="busyId === `role-${mem.membershipId}`"
+                  :disabled="mem.role === 'owner' || busyId === `role-${mem.membershipId}`"
+                  :title="mem.role === 'owner' ? 'مالک همان ثبت‌نام‌کننده است و عوض نمی‌شود' : undefined"
                   @change="
                     setMembershipRole(
                       user.id,
@@ -256,7 +257,11 @@ onMounted(() => {
                     )
                   "
                 >
-                  <option v-for="role in USER_ROLES" :key="role" :value="role">
+                  <option
+                    v-for="role in USER_ROLES.filter((role) => role !== 'owner' || mem.role === 'owner')"
+                    :key="role"
+                    :value="role"
+                  >
                     {{ USER_ROLE_LABELS[role] }}
                   </option>
                 </select>