Prevent duplicate tenant memberships on import

backend/src/routes/admin.ts

@@ -660,10 +660,16 @@ export default async function adminRoutes(server: FastifyInstance) {
                     })
                     .from(authUserRoles),
             ]);
+            const uniqueMembershipRows = Array.from(
+                new Map(membershipRows.map((membership) => [
+                    `${membership.tenant_id}:${membership.user_id}`,
+                    membership,
+                ])).values()
+            );
 
             const users = userRows.map((user) => {
                 const profiles = profileRows.filter((profile) => profile.user_id === user.id);
-                const memberships = membershipRows.filter((membership) => membership.user_id === user.id);
+                const memberships = uniqueMembershipRows.filter((membership) => membership.user_id === user.id);
                 const roleAssignments = roleAssignmentRows.filter((assignment) => assignment.user_id === user.id);
                 const preferredProfile = profiles.find((profile) => profile.active) || profiles[0];
                 const fallbackName = deriveNameFromEmail(user.email);
@@ -683,7 +689,7 @@ export default async function adminRoutes(server: FastifyInstance) {
 
             const tenantsWithCounts = tenantRows.map((tenant) => ({
                 ...tenant,
-                user_count: membershipRows.filter((membership) => membership.tenant_id === tenant.id).length,
+                user_count: uniqueMembershipRows.filter((membership) => membership.tenant_id === tenant.id).length,
             }));
 
             return {
@@ -691,7 +697,7 @@ export default async function adminRoutes(server: FastifyInstance) {
                 tenants: tenantsWithCounts,
                 roles: roleRows,
                 unassignedProfiles: profileRows.filter((profile) => !profile.user_id),
-                memberships: membershipRows,
+                memberships: uniqueMembershipRows,
                 roleAssignments: roleAssignmentRows,
             };
         } catch (err) {

backend/src/routes/auth/me.ts

@@ -69,7 +69,9 @@ export default async function meRoutes(server: FastifyInstance) {
                 .innerJoin(tenants, eq(authTenantUsers.tenant_id, tenants.id))
                 .where(eq(authTenantUsers.user_id, userId))
 
-            const tenantList = tenantRows ?? []
+            const tenantList = Array.from(
+                new Map((tenantRows ?? []).map((tenant) => [tenant.id, tenant])).values()
+            )
 
             // ----------------------------------------------------
             // 3) ACTIVE TENANT