fix: add task suppression to /api/tasks GET route (used by admin 'view as' feature)

This was the 4th location missing the filter — the API endpoint had no
suppression at all, so old/dead tasks showed when admins viewed other users' tasks.

ondeck/src/app/api/tasks/route.ts

@@ -23,16 +23,48 @@ export async function GET(request: NextRequest) {
 
     const where: any = {}
 
-    if (status) where.status = status
-    if (clientId) where.clientId = clientId
-    if (department) where.department = department
-    if (designationId) {
-      where.client = {
-        OR: [
-          { designationId },
-          { designation2Id: designationId },
-        ],
+    // Task suppression: exclude dead policies, expired groups, and old tasks
+    const cutoff = new Date()
+    cutoff.setDate(cutoff.getDate() - 7)
+    const showArchived = searchParams.get('archived') === 'true'
+
+    if (!showArchived) {
+      where.NOT = {
+        policy: { status: { in: ['Cancelled', 'Expired', 'Non-Renewed', 'Rewritten', 'Not taken'] } },
       }
+      where.OR = [
+        { policyGroupId: null },
+        { policyGroup: { renewalDate: { gte: cutoff } } },
+      ]
+      where.AND = [
+        {
+          OR: [
+            { dueDate: { gte: cutoff } },
+            { status: { in: ['COMPLETED', 'CANCELLED', 'NA'] } },
+          ],
+        },
+      ]
+    }
+
+    if (status) where.status = status
+    if (clientId) {
+      if (!where.AND) where.AND = []
+      where.AND.push({ clientId })
+    }
+    if (department) {
+      if (!where.AND) where.AND = []
+      where.AND.push({ department })
+    }
+    if (designationId) {
+      if (!where.AND) where.AND = []
+      where.AND.push({
+        client: {
+          OR: [
+            { designationId },
+            { designation2Id: designationId },
+          ],
+        },
+      })
     }
     if (viewUserId) {
       const userRoles = (session.user as any).roles || []