feat(W1): status lifecycle (suspend/delete/resume) + shared effective-grants lib

- Extract calculateEffectiveGrants into n8n/shared/effective-grants.js
  (single source of truth), inlined at build time into W1/W2/W3 via
  gen_w*.js + inline_shared.js — removes the duplicated algorithm.
- W1 now provisions with a status branch:
  suspended/deleted -> disable AList user + clear role scopes (soft delete)
  active -> create/update user+role, RECOMPUTE desired scopes (never restore
  stale), re-enable
- Loop guard corrected: check AList user LIVE disabled state via
  GET /api/admin/user/get (sync_status alone breaks suspend->resume).
- W2/W3 rebuilt on shared lib (identical behaviour).
- Tests: test_effective_grants.js (15), test_w3_refactored.js (13),
  test_w1_lifecycle.js (23) — all green.
- Drop superseded w2-compute.js / w3-compute.js / test_w3.js.

n8n/inline_shared.js

@@ -0,0 +1,19 @@
+// Shared build helper: inline shared/effective-grants.js into a workflow's
+// Code node body, stripping the module.exports shim. All gen_*.js scripts use
+// this so the "single source of truth" file is what actually ships.
+const fs = require('fs');
+const path = require('path');
+
+const SHARED_PATH = path.join(__dirname, 'shared', 'effective-grants.js');
+const EXPORT_MARKER = '/* SHARED_EXPORT_BEGIN */';
+
+// Returns the shared library source WITHOUT the module.exports block — a
+// plain script ready to prepend to (or include in) a Code node's jsCode.
+function sharedSource() {
+  const src = fs.readFileSync(SHARED_PATH, 'utf8');
+  const idx = src.indexOf(EXPORT_MARKER);
+  if (idx === -1) throw new Error('SHARED_EXPORT_BEGIN marker not found in shared source');
+  return src.slice(0, idx).replace(/\s+$/, '');
+}
+
+module.exports = { sharedSource, SHARED_PATH };