fix(user): skip last-admin guard when target is already unreachable

GuardLastAdmin counted only active, non-deletion-scheduled admins, but gated only on target.IsAdmin. Demoting or deleting an already-disabled or deletion-scheduled admin would then be blocked whenever exactly one active admin remained, even though removing a user who isn't in the reachable set can't reduce the count. Return early when the target isn't part of the counted set.

pkg/user/user.go

@@ -670,6 +670,11 @@ func GuardLastAdmin(s *xorm.Session, target *User) error {
 	if !target.IsAdmin {
 		return nil
 	}
+	// target is not in the counted "reachable admin" set — removing them
+	// doesn't change the invariant, so the guard is a no-op.
+	if target.Status != StatusActive || !target.DeletionScheduledAt.IsZero() {
+		return nil
+	}
 
 	session := s.Where("is_admin = ?", true).
 		And("status = ?", StatusActive).