fix(webapp): follow computed keys and call arguments in the list-filter rule

Two detector gaps hid live call sites. A property whose key cannot be read
statically was skipped entirely, so a computed key inside a where clause hid
the whole branch below it, even though a computed key there is a column name
and its value is still predicate territory. And a filter fragment built by a
helper and spread into where was dropped when the walk reached the call, so it
depended on the helper being named a particular way.

The walk now descends through unreadable keys and into call arguments, which
exposed the two remaining unbounded sites: the run-graph join lookup, whose
sibling target lookup was already bounded, and the member environment lookup.

Author: ericallam

apps/webapp/app/models/member.server.ts

@@ -234,7 +234,7 @@ export async function getProjectsMissingMemberDevelopmentEnvironments({
       organizationId,
       ...memberDevelopmentEnvironmentWhere({
         orgMemberId: memberId,
-        projectId: { in: projects.map((project) => project.id) },
+        projectId: { in: boundedIn(projects.map((project) => project.id)) },
       }),
     },
     select: { projectId: true },

oxlint-plugins/prisma-in-filter.mjs

@@ -117,6 +117,11 @@ function propertyKeyName(node) {
  * Filters are routinely assembled conditionally, so the walk follows the shapes that carry
  * them: `cond ? { … } : {}`, `cond && { … }`, and `...(cond ? { … } : {})`. Stopping at a
  * plain ObjectExpression would leave those permanently invisible to the rule.
+ *
+ * It also follows call arguments, so a filter fragment built by a helper and spread into
+ * `where` is still inspected, and it descends through properties whose key it cannot read
+ * statically. A computed key inside a filter subtree is a column name, so the value below
+ * it is still predicate territory; skipping it would hide the whole branch.
  */
 function reportListFilters(node, context, depth, messageId = "listFilter", extra = {}) {
   if (!node || typeof node !== "object" || depth > 12) return;
@@ -139,6 +144,9 @@ function reportListFilters(node, context, depth, messageId = "listFilter", extra
       return;
     case "SpreadElement":
       return descend(node.argument);
+    case "CallExpression":
+      for (const argument of node.arguments) descend(argument);
+      return;
     default:
       break;
   }
@@ -153,7 +161,13 @@ function reportListFilters(node, context, depth, messageId = "listFilter", extra
     if (property.type !== "Property") continue;
 
     const name = propertyKeyName(property);
-    if (!name || VALUE_POSITION.has(name)) continue;
+
+    if (!name) {
+      descend(property.value);
+      continue;
+    }
+
+    if (VALUE_POSITION.has(name)) continue;
 
     if (LIST_FILTERS.has(name)) {
       if (!isBounded(property.value)) {