Function would_orphan_role 

pub async fn would_orphan_role(
    db: &Db,
    user_id: i64,
    protected_role: Role,
    new_role: Role,
    new_active: bool,
) -> Result<bool>

Would the proposed change leave the system with zero active members of protected_role?

new_role / new_active describe the target row’s proposed state:

• delete: pass new_active = false (the row goes away).
• role change: pass the new role.
• deactivate: pass new_active = false.

Returns true only when:

• exactly one active member of protected_role exists, AND
• the target user IS that member, AND
• the proposed state would remove them from the protected pool.