fix: validate roles, guard last owner, scope bootstrap status

Security review of e70b2f0. The UI gating was correctly backed by
RequireRole everywhere; these are the missing validation gaps behind it.

- UpdateUserRole and createOrgUser accepted any role string verbatim, so
  an admin could self-promote to owner, create an owner outright, or set
  a junk role that silently stripped a user's access. Roles are now
  whitelisted, only an owner may grant or remove the owner role, and an
  actor cannot change their own.
- Neither demote nor delete guarded the last owner, so an org could reach
  zero owners. Both now refuse when no owner would remain, returning 409.
  Self-delete rejected.
- CountUsers counted across all orgs, so a locked-out org could never
  re-bootstrap once another tenant existed, and the unauthenticated
  bootstrap-status endpoint reported instance-wide state. It now answers
  per-org on an org host, falling back to global only on the apex.
- HandleMe repeats the middleware's host/org check; it sits outside the
  middleware so it can still return its own 401.
- Post-bootstrap now sends the new owner to their org host's login page.
  The session cookie is deliberately scoped to the exact host, so the old
  redirect landed them unauthenticated.
- AuthProvider renders an error state instead of mounting the shell with
  a null user when /auth/me fails for a reason other than 401.
- api.ts unwraps {"error": ...} so these messages render as text.

server/internal/services/users.go

@@ -2,6 +2,7 @@ package services
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"strings"
 	"time"
@@ -14,17 +15,56 @@ import (
 	"golang.org/x/crypto/bcrypt"
 )
 
+// ErrLastOwner is returned when an operation would leave an org with no owner,
+// which would lock every remaining member out of org administration.
+var ErrLastOwner = errors.New("this is the organization's last owner — promote another member to owner first")
+
+// CountUsers counts users across the whole instance. It answers "is this a
+// brand new deployment", so it is deliberately unscoped; anything that asks
+// about a single tenant must use CountOrgUsers.
 func CountUsers() (int64, error) {
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
 	return db.Col("users").CountDocuments(ctx, bson.M{})
 }
 
+func CountOrgUsers(orgID string) (int64, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return db.Col("users").CountDocuments(ctx, bson.M{"org_id": orgID})
+}
+
+// countOtherOwners counts owner-role users in the org excluding exceptUserID,
+// i.e. how many owners would remain if that user were removed or demoted.
+func countOtherOwners(orgID, exceptUserID string) (int64, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	return db.Col("users").CountDocuments(ctx, bson.M{
+		"org_id":  orgID,
+		"role":    models.RoleOwner,
+		"user_id": bson.M{"$ne": exceptUserID},
+	})
+}
+
+func GetUserInOrg(orgID, userID string) (*models.User, error) {
+	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+	defer cancel()
+	var u models.User
+	err := db.Col("users").FindOne(ctx, bson.M{"user_id": userID, "org_id": orgID}).Decode(&u)
+	if err != nil {
+		return nil, err
+	}
+	return &u, nil
+}
+
 func CreateUser(orgID, email, password, role, authSource string) (*models.User, error) {
 	email = strings.ToLower(strings.TrimSpace(email))
 	if email == "" {
 		return nil, fmt.Errorf("email required")
 	}
+	if !models.ValidRole(role) {
+		return nil, fmt.Errorf("invalid role %q", role)
+	}
 	u := &models.User{
 		UserID:     uuid.NewString(),
 		OrgID:      orgID,
@@ -95,17 +135,49 @@ func ListUsers(orgID string) ([]models.User, error) {
 }
 
 func UpdateUserRole(orgID, userID, role string) error {
+	if !models.ValidRole(role) {
+		return fmt.Errorf("invalid role %q", role)
+	}
+	target, err := GetUserInOrg(orgID, userID)
+	if err != nil {
+		return fmt.Errorf("user not found")
+	}
+	// Demoting the final owner would leave nobody able to administer the org.
+	if target.Role == models.RoleOwner && role != models.RoleOwner {
+		others, err := countOtherOwners(orgID, userID)
+		if err != nil {
+			return err
+		}
+		if others == 0 {
+			return ErrLastOwner
+		}
+	}
+
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
-	_, err := db.Col("users").UpdateOne(ctx,
+	_, err = db.Col("users").UpdateOne(ctx,
 		bson.M{"user_id": userID, "org_id": orgID},
 		bson.M{"$set": bson.M{"role": role}})
 	return err
 }
 
 func DeleteUser(orgID, userID string) error {
+	target, err := GetUserInOrg(orgID, userID)
+	if err != nil {
+		return fmt.Errorf("user not found")
+	}
+	if target.Role == models.RoleOwner {
+		others, err := countOtherOwners(orgID, userID)
+		if err != nil {
+			return err
+		}
+		if others == 0 {
+			return ErrLastOwner
+		}
+	}
+
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
 	defer cancel()
-	_, err := db.Col("users").DeleteOne(ctx, bson.M{"user_id": userID, "org_id": orgID})
+	_, err = db.Col("users").DeleteOne(ctx, bson.M{"user_id": userID, "org_id": orgID})
 	return err
 }