fix: resolve tenant member removal and move aggregation bugs

- adminfront: Update removeMutation to correctly pass 'isRemoveTenant: true' and the specific tenant slug instead of empty string
- backend: Fix 'Move' operation (Normal Update) in UpdateUser to correctly remove the old primary company code from the 'companyCodes' array and sync the deletion to Keto, ensuring accurate member count aggregation

adminfront/src/features/user-groups/routes/TenantUserGroupsTab.tsx

@@ -229,7 +229,8 @@ const MemberTable: React.FC<{
   });
 
   const removeMutation = useMutation({
-    mutationFn: (userId: string) => updateUser(userId, { tenantSlug: "" }),
+    mutationFn: (userId: string) =>
+      updateUser(userId, { tenantSlug, isRemoveTenant: true }),
     onSuccess: () => {
       queryClient.invalidateQueries({ queryKey: ["tenants-full-tree-v2"] });
       toast.success(t("msg.info.saved_success", "조직에서 제외되었습니다."));

backend/internal/handler/user_handler.go

@@ -1588,7 +1588,35 @@ func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {
 				}
 			}
 		} else {
-			// Normal update: replace primary company code and ensure it's in existingCodes
+		        // Normal update (Move): replace primary company code and remove the old one from existingCodes
+		        currentPrimary := extractTraitString(traits, "companyCode")
+		        if currentPrimary != "" && currentPrimary != code {
+		                // Remove old primary from existingCodes
+		                var newCodes []string
+		                for _, existing := range existingCodes {
+		                        if existing != currentPrimary {
+		                                newCodes = append(newCodes, existing)
+		                        }
+		                }
+		                existingCodes = newCodes
+
+		                // [Keto Sync] Remove membership for the old tenant
+		                if h.TenantService != nil && h.KetoOutboxRepo != nil {
+		                        go func(removedSlug string) {
+		                                bgCtx := context.Background()
+		                                if t, err := h.TenantService.GetTenantBySlug(bgCtx, removedSlug); err == nil && t != nil {
+		                                        _ = h.KetoOutboxRepo.Create(bgCtx, &domain.KetoOutbox{
+		                                                Namespace: "Tenant",
+		                                                Object:    t.ID,
+		                                                Relation:  "members",
+		                                                Subject:   "User:" + userID,
+		                                                Action:    domain.KetoOutboxActionDelete,
+		                                        })
+		                                }
+		                        }(currentPrimary)
+		                }
+		        }
+
 		        traits["companyCode"] = code
 		        // Resolve TenantID for Kratos Trait
 		        if h.TenantService != nil && code != "" {
@@ -1607,8 +1635,7 @@ func (h *UserHandler) UpdateUser(c *fiber.Ctx) error {
 		        if !found && code != "" {
 		                existingCodes = append(existingCodes, code)
 		        }
-		}
+		}	}
-	}
 
 	// Deduplicate and save back companyCodes
 	var codesToSave []string