Fix audit endpoints dropping rows whose related active_* row is soft-deleted

[somethingnew2-0]

Summary

• Removes the joinedload(active_user) / joinedload(active_role_group) introduced by the FastAPI migration in Migrate from Flask + Marshmallow to FastAPI + Pydantic #425 that caused audit pages to silently drop rows whose user or role group had been soft-deleted (reducing one production page from 398 entries to 19).
• Drops the matching unused active_* fields from the audit response schemas — the user / group / role_group fields (with their existing deleted_at columns) are all the frontend reads off audit rows; no consumer touches the active_* keys.
• Adds regression tests for the soft-deleted user and soft-deleted role-group cases.

Why

OktaUserGroupMember.active_user and RoleGroupMap.active_role_group are defined with innerjoin=True plus a primaryjoin filter on deleted_at IS NULL. When the migration eager-loaded them via joinedload(...), SQLAlchemy emitted INNER JOINs that excluded any row whose target had since been soft-deleted, even though the audit row itself is valid history. selectinload(active_group) / selectinload(active_role_group_mapping) don't cause the same regression but were unused additions on the response and have been dropped for consistency with the pre-migration Flask wire shape. The base joinedload(user) / joinedload(group) / joinedload(role_group) (all unfiltered) plus the existing deleted_at on the row helpers give the frontend everything it needs to render soft-deleted entities.

The shared helper api/routers/_eager.py:40 has the same joinedload(active_user) pattern but is used by groups/apps/users/role_requests routes whose consumers do read active_user, so the fix there is joinedload(..., innerjoin=False) or selectinload(...) rather than deletion — left for a separate follow-up.

Test plan

• pytest tests/ — 424 passed
• New test_users_audit_returns_rows_when_user_is_soft_deleted and test_groups_audit_returns_rows_when_role_group_is_soft_deleted cover the regression
• ruff check clean on the touched files
• UI smoke: /groups/Role-All-Employees/audit?active=false shows soft-deleted users with the strikethrough style (handled by the existing displayUserName helper off user.deleted_at)

🤖 Generated with Claude Code