fix: prevent invalid member organization date ranges (DE-931)

[skwowet]

Summary

• Add a shared helper to sanitize/validate member organization date ranges.
• Sanitize enrichment work experience dates before persistence.
• Validate work experience date ranges at API/service boundaries, including partial updates.

---

Note

Medium Risk
Touches multiple write paths (public API, core member-org service, enrichment worker) and changes date nullability/validation behavior, which could affect existing clients and deduplication/unique-conflict behavior if assumptions about date formats differ.

Overview
Prevents invalid member work-experience date ranges from being persisted by introducing a shared sanitizeMemberOrganizationDateRange helper and wiring it into create/update flows.

Public work-experience create/update endpoints now validate/sanitize startDate/endDate and return 400 BadRequest on invalid ranges, and the member org service layer applies the same validation (including for partial updates) while recalculating affiliations for both the old and new org when the org changes.

The enrichment worker now normalizes incoming work-experience dates (invalid ranges become null), updates enrichment organization types to allow null dates, and related types/data-access code are adjusted to accept nullable dateStart/dateEnd plus a new fetchMemberOrganizationById helper for safer updates.

^{Reviewed by Cursor Bugbot for commit ba435cc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 01b646b. Configure here.}