fix: exclude terminated agents from list and org chart endpoints

Terminated agents (e.g. from rejected hire approvals) were visible in
GET /companies/:companyId/agents and GET /companies/:companyId/org because
list() and orgForCompany() had no status filtering.

- Add ne(agents.status, "terminated") filter to both queries
- Add optional { includeTerminated: true } param to list() for callers
  that need all agents (e.g. company-portability export with skip counting)
- orgForCompany() always excludes terminated (no escape hatch needed)

Fixes #5

server/src/services/company-portability.ts

@@ -556,7 +556,7 @@ export function companyPortabilityService(db: Db) {
       requiredSecrets: [],
     };
 
-    const allAgentRows = include.agents ? await agents.list(companyId) : [];
+    const allAgentRows = include.agents ? await agents.list(companyId, { includeTerminated: true }) : [];
     const agentRows = allAgentRows.filter((agent) => agent.status !== "terminated");
     if (include.agents) {
       const skipped = allAgentRows.length - agentRows.length;