Merge pull request 'Roles: prune unused seeded staff roles down to the org�s four' (#62) from Talha into main

backend/migrations/manual/026_prune_unused_staff_roles.sql

@@ -0,0 +1,24 @@
+-- 026: The organisation runs four staff roles — system_administrator,
+-- recruiter, hiring_manager, department_head. Soft-delete the unused seeded
+-- staff roles (hr_administrator, interviewer, ceo) so they stop appearing in
+-- the Access Control screen and every role picker (listings filter on
+-- is_deleted).
+--
+-- NOT touched:
+--   * candidate — not a staff role: every applicant account is a role-8 user
+--     and the Candidates screen is keyed to it.
+--   * any role that still has live members — pruning a role out from under a
+--     user would strand their permissions; such a role keeps working until
+--     the members are reassigned by hand, and this migration (idempotent)
+--     picks it up on a later boot.
+UPDATE app.roles r
+SET is_deleted = TRUE,
+    is_active  = FALSE,
+    updated_at = NOW()
+WHERE r.role_name IN ('hr_administrator', 'interviewer', 'ceo')
+  AND r.is_deleted = FALSE
+  AND NOT EXISTS (
+    SELECT 1 FROM app.users u
+    WHERE u.role_id = r.id
+      AND COALESCE(u.is_deleted, FALSE) = FALSE
+  );