Split user remove and archive actions

Restore RemoveUser as a hard delete operation and surface dependency\nconflicts with a dedicated IAM error.\n\nAdd a new ArchiveUser flow that deactivates profiles while keeping the\nmember in the organization, then expose both actions across Connect, MCP,\nCLI, n8n, console UI, and e2e coverage.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>

pkg/iam/errors.go

@@ -157,6 +157,18 @@ func (e ErrUserManagedBySCIM) Error() string {
 	return fmt.Sprintf("user %q is managed by SCIM and cannot be deleted manually", e.ProfileID)
 }
 
+type ErrUserReferencedByRecords struct {
+	ProfileID gid.GID
+}
+
+func NewUserReferencedByRecordsError(profileID gid.GID) error {
+	return &ErrUserReferencedByRecords{ProfileID: profileID}
+}
+
+func (e ErrUserReferencedByRecords) Error() string {
+	return "cannot remove user because they are referenced by existing records (for example signatures, tasks, assets, or risks)"
+}
+
 type ErrLastActiveOwner struct {
 	MembershipID gid.GID
 }