Read members from the directory and add email search

.changeset/member-directory-readers.md

@@ -0,0 +1,10 @@
+---
+"@executor-js/cloud": patch
+"@executor-js/api": patch
+"@executor-js/react": patch
+"@executor-js/sdk": patch
+---
+
+Member lists, the admin users page, and seat counts on cloud now read from the local membership mirror through the shared `MemberDirectory` seam instead of fanning out one WorkOS read per member. The admin users page gains an email/name search.
+
+**Deploy prerequisite (cloud):** `bun run --cwd apps/cloud db:backfill-workos-mirror:prod` must complete before this build is deployed, and its printed membership count should match WorkOS. Until the backfill has stamped the mirror's marker, seat reporting to Autumn is skipped with a warning (never a partial count) and member lists show only members who have signed in since the mirror shipped.

.changeset/member-directory-reconciler.md

@@ -0,0 +1,7 @@
+---
+"@executor-js/cloud": patch
+---
+
+The cloud membership mirror is now reconciled from the WorkOS Events API: an every-minute cron replays user, organization-membership, and organization events from a persisted cursor, so changes made in the WorkOS dashboard (a removed member, a role edit, a profile update) reach the mirror without anyone signing in. A signed webhook at `/api/webhooks/workos` pokes the same reconciler so those changes land in seconds, and `bun run --cwd apps/cloud db:drain-workos-events:prod` runs the same replay out-of-band until the stream is drained.
+
+**Ops steps (cloud):** set the webhook signing secret with `wrangler secret put WORKOS_WEBHOOK_SECRET`, then register `https://executor.sh/api/webhooks/workos` as a webhook endpoint in the WorkOS dashboard for the `user.*`, `organization_membership.*`, `organization.updated`, and `organization.deleted` events. Until the secret is set the route answers 503 and the cron alone keeps the mirror current.

apps/cloud/drizzle/0020_workos_sync_drained_at.sql

@@ -0,0 +1 @@
+ALTER TABLE "workos_sync" ADD COLUMN "drained_at" timestamp with time zone;