Cannot promote anyone to org Owner — LAST_OWNER guard fires incorrectly on role promotion

## Bug Promoting another org member to **Owner** fails with a generic toast ("Could not update role. Please try again."). The backend rejects the request with a `LAST_OWNER` error that is logically wrong for a promotion: adding a second owner can never leave the org without an owner. ## Reproduction 1. Be the sole owner of an org (1 Owner, N Members). 2. Open **Manage Members** on the org. 3. On any other member, open the `...` menu → change role to **Owner**. 4. Toast: `Could not update role. Please try again.` ## Backend response `POST` to the change-role endpoint on `dev.gathrings.com` returns **HTTP 400** with: ```json { "ok": false, "code": "LAST_OWNER", "message": "Cannot change role. You may be the last owner." } ``` ## Expected Promoting a member to Owner should succeed. The org now has 2 owners. The `LAST_OWNER` guard should fire **only** when the action would reduce the active owner count to 0 — i.e. demoting/removing the last Owner. Promoting another user **to** Owner increases the count; the guard should not apply. ## Likely root cause One of: 1. The guard is checking `is_single_owner(org)` on the requesting user (alexis) instead of validating the **target** user's new role. It wrongly concludes "you are the last owner, so you can't change anyone's role." 2. The guard runs on every role-change call regardless of direction (promotion vs. demotion). It should only run when the net effect is `active_owners -= 1`. 3. The role-change service swaps roles instead of assigning the new role independently (i.e. treats promotion as "alexis → Member, target → Owner"), which would trip the guard. ## Impact - Sole owners cannot onboard any co-owner. Every org with exactly 1 owner is permanently stuck at 1 owner. - Blocks delegation, succession, and any workflow that needs more than one owner. - No way out without DB-level intervention. ## Secondary issues to address - Frontend toast is generic — surface the backend's `code` / `message` so the user sees "Cannot change role — last owner" instead of a useless retry prompt. - Regardless of this fix, the UI could disable the "Promote to Owner" menu item on self (last-owner self-demotion guard makes sense) but keep it enabled on other members. ## Environment - Environment: `dev.gathrings.com` - User: sole owner (alexis) on the org shown in the screenshot - Action: promote Member → Owner ## Found by Manual testing