Archive manual users on remove

Switch remove-user behavior for manually managed profiles from hard\ndelete to archival by deactivating the profile. This matches the\nrequested SCIM-like lifecycle while avoiding dependency errors for\nlinked records such as signatures and assets.\n\nThe remove flow now updates profile state to INACTIVE, updates\nmembership timestamps, and emits a user-updated webhook event instead of\ndelete events. E2E coverage now asserts that remove keeps the profile\nand marks it inactive.

Signed-off-by: Cursor Agent <cursoragent@cursor.com>

e2e/console/user_test.go

@@ -131,6 +131,7 @@ func TestUser_RemoveUser(t *testing.T) {
 						edges {
 							node {
 								id
+								state
 								membership {
 									role
 								}
@@ -148,6 +149,7 @@ func TestUser_RemoveUser(t *testing.T) {
 				Edges []struct {
 					Node struct {
 						ID         string `json:"id"`
+						State      string `json:"state"`
 						Membership struct {
 							Role string `json:"role"`
 						} `json:"membership"`
@@ -198,6 +200,24 @@ func TestUser_RemoveUser(t *testing.T) {
 	require.NoError(t, err)
 
 	assert.Equal(t, userID, mutationResult.RemoveUser.DeletedProfileID)
+
+	// Remove archives the user instead of hard-deleting them.
+	err = owner.ExecuteConnect(query, map[string]any{
+		"id": owner.GetOrganizationID().String(),
+	}, &result)
+	require.NoError(t, err)
+
+	var removedUserState string
+
+	for _, edge := range result.Node.Profiles.Edges {
+		if edge.Node.ID == userID {
+			removedUserState = edge.Node.State
+			break
+		}
+	}
+
+	require.NotEmpty(t, removedUserState, "Should still find archived user")
+	assert.Equal(t, "INACTIVE", removedUserState)
 }
 
 func TestUser_RemoveOwner(t *testing.T) {