feat(platform): harden access scoping and delivery baseline

apps/web/src/app/(app)/projects/[id]/scenario/page.tsx

@@ -20,7 +20,7 @@ export default async function ScenarioPage({ params }: ScenarioPageProps) {
 
   // Load resources and roles for the pickers
   const [resources, roles] = await Promise.all([
-    trpc.resource.list({ isActive: true }),
+    trpc.resource.listStaff({ isActive: true }),
     trpc.role.list({ isActive: true }),
   ]);
 

apps/web/src/app/(app)/resources/ResourcesClient.tsx

@@ -212,7 +212,7 @@ export function ResourcesClient() {
     fetchNextPage,
     hasNextPage,
     // Keep this boundary shallow; the full TRPC inference here trips TS depth limits.
-  } = (trpc.resource.list.useInfiniteQuery as any)(
+  } = (trpc.resource.listStaff.useInfiniteQuery as any)(
     {
       isActive: isActiveFilter === "all" ? undefined : isActiveFilter === "active",
       search: search || undefined,
@@ -309,13 +309,15 @@ export function ResourcesClient() {
 
   // ─── Mutations ────────────────────────────────────────────────────────────
   const deactivateMutation = trpc.resource.deactivate.useMutation({
-    onSuccess: async () => {
-      await utils.resource.list.invalidate();
+    onSuccess: () => {
+      void utils.resource.directory.invalidate();
+      void utils.resource.listStaff.invalidate();
     },
   });
   const batchDeactivateMutation = trpc.resource.batchDeactivate.useMutation({
-    onSuccess: async () => {
-      await utils.resource.list.invalidate();
+    onSuccess: () => {
+      void utils.resource.directory.invalidate();
+      void utils.resource.listStaff.invalidate();
       selection.clear();
     },
   });