sprint10+11: AI permission filter + API token scopes + merge check + owner transfer service + auto-transfer on deactivation

app/routes/users.py

@@ -18,6 +18,7 @@ from app.deps import get_current_user, require_permission
 from app.models.user import User, UserTenant
 from app.schemas.user import UserCreate, UserUpdate, UserResponse, PaginatedUsers
 from app.services.user_service import user_service, _UNSET
+from app.services.owner_transfer_service import transfer_ownership
 
 router = APIRouter(prefix="/api/v1/users", tags=["users"])
 
@@ -235,6 +236,16 @@ async def update_user(
         raise HTTPException(404, detail={"detail": "User not found", "code": "not_found"})
 
     user, user_tenant = result
+
+    # Auto-transfer ownership when user is deactivated
+    if body.is_active is False:
+        await transfer_ownership(
+            db,
+            tenant_id,
+            from_user_id=uid,
+            to_user_id=acting_user_id,
+        )
+
     await log_audit(db, tenant_id, acting_user_id, "update", "user", uid, changes=changes)
 
     # Invalidate permission cache for the updated user