Cancel signature requests when a contract ends

When UpdateUser sets a contract end date that is already in the past,
the user can no longer fulfill outstanding signature requests. Delete
their still-pending requests as part of the same update so they stop
appearing as awaiting signatures.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/iam/organization_service.go

@@ -1102,12 +1102,20 @@ func (s *OrganizationService) UpdateUser(ctx context.Context, req *UpdateUserReq
 				profile.ContractEndDate = *req.ContractEndDate
 			}
 
-			profile.UpdatedAt = time.Now()
+			now := time.Now()
+			profile.UpdatedAt = now
 
 			if err := profile.Update(ctx, conn, scope); err != nil {
 				return fmt.Errorf("cannot update profile: %w", err)
 			}
 
+			if profile.ContractEndDate != nil && profile.ContractEndDate.Before(now) {
+				signatures := &coredata.DocumentVersionSignatures{}
+				if err := signatures.DeleteRequestedBySignatory(ctx, conn, scope, profile.ID); err != nil {
+					return fmt.Errorf("cannot delete requested signatures: %w", err)
+				}
+			}
+
 			membership := &coredata.Membership{}
 
 			var webhookPayload *webhooktypes.User