fix(GRO-206): CTO review fixes — active filter on super user count + CI TAG fix

- Add active=true filter to all 3 super user count queries in staff.ts
  (revoke, deactivate, delete) so inactive super users aren't counted
- Fix ci.yml deploy step: use steps.version.outputs.tag instead of
  invalid github.sha::7 expression
- Remove GRO-206 CI trigger junk line from README.md

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/ci.yml

@@ -212,7 +212,7 @@ jobs:
 
       - name: Deploy to groombook-dev
         env:
-          TAG: pr-${{ github.event.pull_request.number }}-${{ github.sha::7 }}
+          TAG: ${{ steps.version.outputs.tag }}
           PR_NUM: ${{ github.event.pull_request.number }}
         run: |
           echo "Deploying images tagged $TAG to groombook-dev..."

README.md

@@ -215,4 +215,3 @@ All PRs require CI to pass before merge. See [CONTRIBUTING.md](./CONTRIBUTING.md
 ## License
 
 AGPL-3.0
-# GRO-206 CI trigger

apps/api/src/routes/staff.ts

@@ -65,7 +65,7 @@ staffRouter.patch("/:id", zValidator("json", updateStaffSchema), async (c) => {
     const superUserCount = await db
       .select({ id: staff.id })
       .from(staff)
-      .where(eq(staff.isSuperUser, true))
+      .where(and(eq(staff.isSuperUser, true), eq(staff.active, true)))
       .limit(2); // just need count; fetch 2 to know if > 1
     if (superUserCount.length <= 1) {
       return c.json(
@@ -86,7 +86,7 @@ staffRouter.patch("/:id", zValidator("json", updateStaffSchema), async (c) => {
       const superUserCount = await db
         .select({ id: staff.id })
         .from(staff)
-        .where(eq(staff.isSuperUser, true))
+        .where(and(eq(staff.isSuperUser, true), eq(staff.active, true)))
         .limit(2);
       if (superUserCount.length <= 1) {
         return c.json(
@@ -142,7 +142,7 @@ staffRouter.delete("/:id", async (c) => {
     const superUserCount = await db
       .select({ id: staff.id })
       .from(staff)
-      .where(eq(staff.isSuperUser, true))
+      .where(and(eq(staff.isSuperUser, true), eq(staff.active, true)))
       .limit(2);
     if (superUserCount.length <= 1) {
       return c.json(