v0.10.7 UI rule changes

backend/src/routes/groups.js

@@ -255,7 +255,15 @@ router.delete('/:id/members/:userId', authMiddleware, async (req, res) => {
     if (group.type !== 'private') return res.status(400).json({ error: 'Cannot remove members from public groups' });
     if (group.owner_id !== req.user.id && req.user.role !== 'admin') return res.status(403).json({ error: 'Only owner or admin can remove members' });
     const targetId = parseInt(req.params.userId);
-    if (targetId === group.owner_id) return res.status(400).json({ error: 'Cannot remove the group owner' });
+    // Admins can remove the owner only if the owner is a deleted user (orphan cleanup)
+    const targetUser = await queryOne(req.schema, 'SELECT status FROM users WHERE id=$1', [targetId]);
+    const isDeletedOrphan = targetUser?.status === 'deleted';
+    if (targetId === group.owner_id && !isDeletedOrphan && req.user.role !== 'admin') {
+      return res.status(400).json({ error: 'Cannot remove the group owner' });
+    }
+    if (targetId === group.owner_id && !isDeletedOrphan) {
+      return res.status(400).json({ error: 'Cannot remove the group owner' });
+    }
     const removedUser = await queryOne(req.schema, 'SELECT name,display_name FROM users WHERE id=$1', [targetId]);
     const removedName = removedUser?.display_name || removedUser?.name || 'Unknown';
     await exec(req.schema, 'DELETE FROM group_members WHERE group_id=$1 AND user_id=$2', [group.id, targetId]);