Application members should not see deleted applications.

This updates the `Portfolios.for_user` method to screen out deleted
ApplicationRole entities. For extra assurance, we also mark application
roles as disabled when they are deleted.

atst/domain/applications.py

@@ -63,6 +63,7 @@ class Applications(BaseDomainClass):
 
         for role in application.roles:
             role.deleted = True
+            role.status = ApplicationRoleStatus.DISABLED
             db.session.add(role)
 
         db.session.add(application)

atst/domain/portfolios/query.py

@@ -35,6 +35,7 @@ class PortfoliosQuery(Query):
                                     ApplicationRole.status
                                     == ApplicationRoleStatus.ACTIVE
                                 )
+                                .filter(ApplicationRole.deleted == False)
                                 .subquery()
                             )
                         )