Secrets RBAC: principal resolver doesn't filter soft-deleted users/teams (residual access) #10346

Discovered during review of #10344 (secrets access audit). Latent gap in the forward principal resolver, not introduced by that PR.

services/secrets_principal_resolver.py reads team_memberships / user_roles / llc_company_memberships with no filter on user/team soft-delete (User.is_deleted/is_active, team deleted_at). So a soft-deleted user (or membership in a soft-deleted team) still resolves into PrincipalFacts.accessible_vaults() and would be granted secret access by UnifiedSecretsService.read.

The new access-audit (#10344) faithfully mirrors this (it over-reports exactly as much as the live path over-grants — by design), which is what surfaced it.

Fix: filter soft-deleted principals in resolve_principal_facts (and correspondingly in services/secrets_access_audit.py::_members_of). Confirm the exact soft-delete columns on User/Team.

Priority: medium (requires a still-valid session for the soft-deleted user, but it's a real residual-access path).