Fix remaining stale docs and add mutual exclusivity tests

- Fix two remaining config.d.ts entries that still referenced the
  automatic accountEnabled base filter
- Add tests verifying that userFilter + userGroupMemberFilter and
  userFilter + userGroupMemberSearch are rejected

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>

plugins/catalog-backend-module-msgraph/config.d.ts

@@ -164,7 +164,8 @@ export interface Config {
               expand?: string;
               /**
                * The filter to apply to extract users.
-               * Combined with the base `accountEnabled eq true` filter
+               * Disabled users (accountEnabled === false) are always
+               * filtered out client-side regardless of this setting.
                *
                * E.g. "userType eq 'member'"
                */
@@ -298,7 +299,8 @@ export interface Config {
                 expand?: string;
                 /**
                  * The filter to apply to extract users.
-                 * Combined with the base `accountEnabled eq true` filter
+                 * Disabled users (accountEnabled === false) are always
+                 * filtered out client-side regardless of this setting.
                  *
                  * E.g. "userType eq 'member'"
                  */

plugins/catalog-backend-module-msgraph/src/microsoftGraph/config.test.ts

@@ -197,6 +197,44 @@ describe('readProviderConfigs', () => {
     expect(actual).toEqual(expected);
   });
 
+  it('should reject userFilter combined with userGroupMemberFilter', () => {
+    const config = {
+      catalog: {
+        providers: {
+          microsoftGraphOrg: {
+            customProviderId: {
+              tenantId: 'tenantId',
+              user: { filter: "userType eq 'member'" },
+              userGroupMember: { filter: "displayName eq 'Team'" },
+            },
+          },
+        },
+      },
+    };
+    expect(() => readProviderConfigs(new ConfigReader(config))).toThrow(
+      'mutually exclusive',
+    );
+  });
+
+  it('should reject userFilter combined with userGroupMemberSearch', () => {
+    const config = {
+      catalog: {
+        providers: {
+          microsoftGraphOrg: {
+            customProviderId: {
+              tenantId: 'tenantId',
+              user: { filter: "userType eq 'member'" },
+              userGroupMember: { search: '"displayName:team"' },
+            },
+          },
+        },
+      },
+    };
+    expect(() => readProviderConfigs(new ConfigReader(config))).toThrow(
+      'userGroupMemberSearch cannot be specified',
+    );
+  });
+
   it('should fail if clientId is set without clientSecret', () => {
     const config = {
       catalog: {