Validate facets against base authorization, not active drilldowns
Observation (2026-09-04, code review of theft PR #723 / COR-3895): when URL filter values are normalized against the currently selected team/user drilldown, a valid organization-wide value with zero rows in that drilldown can normalize to an empty selection and accidentally behav…