feat(db): add deletedAt audit timestamp to soft-deletable models

Add deletedAt DateTime? to User, Client, Role, Resource, and Blueprint
models for GDPR-compliant deactivation audit trail. Soft-delete mutations
now stamp deletedAt: new Date() on deactivation and clear it on
reactivation. Migration and test assertions updated accordingly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/api/src/router/user-procedure-support.ts

@@ -473,7 +473,7 @@ export async function deactivateUser(
     throw new TRPCError({ code: "BAD_REQUEST", message: "User is already inactive." });
   }
 
-  await ctx.db.user.update({ where: { id: input.userId }, data: { isActive: false } });
+  await ctx.db.user.update({ where: { id: input.userId }, data: { isActive: false, deletedAt: new Date() } });
 
   // Invalidate all existing sessions so the user is logged out immediately
   await ctx.db.activeSession.deleteMany({ where: { userId: input.userId } });
@@ -506,7 +506,7 @@ export async function reactivateUser(
     throw new TRPCError({ code: "BAD_REQUEST", message: "User is already active." });
   }
 
-  await ctx.db.user.update({ where: { id: input.userId }, data: { isActive: true } });
+  await ctx.db.user.update({ where: { id: input.userId }, data: { isActive: true, deletedAt: null } });
 
   audit({
     entityType: "User",