Reject signature and approval requests for people with ended contracts

Add server-side validation in BulkRequestSignatures, RequestSignature,
and RequestApproval to load the referenced profiles and verify none
have an ended contract before proceeding. Returns ErrProfileContractEnded
if a profile's contract_end_date is in the past, surfaced as a CONFLICT
GraphQL error in all three resolvers.

Signed-off-by: Sacha Al Himdani <sacha@getprobo.com>

apps/console/src/pages/organizations/documents/_components/SignatureDocumentsDialog.tsx

@@ -37,6 +37,7 @@ import { graphql } from "relay-runtime";
 import { z } from "zod";
 
 import type { SignatureDocumentsDialogMutation } from "#/__generated__/core/SignatureDocumentsDialogMutation.graphql";
+import type { SignatureDocumentsDialogPeopleFragment$key } from "#/__generated__/core/SignatureDocumentsDialogPeopleFragment.graphql";
 import type { SignatureDocumentsDialogPeopleQuery } from "#/__generated__/core/SignatureDocumentsDialogPeopleQuery.graphql";
 import type { SignatureDocumentsDialogPeopleRefetchQuery } from "#/__generated__/core/SignatureDocumentsDialogPeopleRefetchQuery.graphql";
 import { useFormWithSchema } from "#/hooks/useFormWithSchema";
@@ -203,7 +204,10 @@ function PeopleList({
     hasNext,
     loadNext,
     isLoadingNext,
-  } = usePaginationFragment<SignatureDocumentsDialogPeopleRefetchQuery>(
+  } = usePaginationFragment<
+    SignatureDocumentsDialogPeopleRefetchQuery,
+    SignatureDocumentsDialogPeopleFragment$key
+  >(
     signatureDocumentsDialogPeopleFragment,
     data.organization,
   );