fix: profile approval 500 — users table has no role column

activate_profile_after_final_approval ran UPDATE users SET role = $1,
but users only has role_id (FK into roles), never a plain role column.
Resolve the role's id via RoleRepository::get_by_key first and update
role_id instead, matching how role is tracked everywhere else.

apps/users/src/handlers/approvals.rs

@@ -223,16 +223,17 @@ async fn activate_profile_after_final_approval(
         sqlx::query(&query).bind(user_role_profile_id).execute(&state.pool).await?;
     }
 
-    // Update user's role to match the approved role_key and set status to ACTIVE
-    sqlx::query(
-        "UPDATE users SET role = $1, status = 'ACTIVE', updated_at = NOW() WHERE id = $2",
-    )
-    .bind(&role_key)
-    .bind(user_id)
-    .execute(&state.pool)
-    .await?;
-
+    // Update user's role to match the approved role_key and set status to ACTIVE.
+    // `users` has no `role` text column — role is tracked via `role_id` FK into `roles`.
     if let Ok(role) = RoleRepository::get_by_key(&state.pool, &role_key).await {
+        sqlx::query(
+            "UPDATE users SET role_id = $1, status = 'ACTIVE', updated_at = NOW() WHERE id = $2",
+        )
+        .bind(role.id)
+        .bind(user_id)
+        .execute(&state.pool)
+        .await?;
+
         sqlx::query(
             "INSERT INTO user_role_assignments (user_id, role_id, status, approved_at) VALUES ($1, $2, 'APPROVED', NOW()) ON CONFLICT (user_id, role_id) DO UPDATE SET status = 'APPROVED', approved_at = NOW()",
         )