Filter inactive people from signature request recipients

The signature request recipient lists (both the multi-select dialog
and the document signatures page) included people who were inactive
via SCIM deactivation. The existing filter only excluded people with
ended contracts but not those with an INACTIVE state.

This adds state: ACTIVE to the ProfileFilter in both frontend queries
and introduces a server-side ErrProfileInactive validation in the
RequestSignature and BulkRequestSignatures service methods to reject
inactive profiles even if called directly via API.

Co-authored-by: Émile Ré <nemile.re@gmail.com>
Signed-off-by: Émile Ré <emile@getprobo.com>
Signed-off-by: Émile Ré <emile@probo.com>

apps/console/src/pages/organizations/documents/_components/SignatureDocumentsDialog.tsx

@@ -196,7 +196,7 @@ function PeopleList({
     signatureDocumentsDialogPeopleQuery,
     {
       organizationId,
-      filter: { contractEnded: false },
+      filter: { contractEnded: false, state: "ACTIVE" },
     },
   );
   const {

apps/console/src/pages/organizations/documents/signatures/DocumentSignaturesPage.tsx

@@ -27,7 +27,7 @@ export const documentSignaturesPageQuery = graphql`
   query DocumentSignaturesPageQuery($documentId: ID! $organizationId: ID! $versionId: ID! $versionSpecified: Boolean!) {
     organization: node(id: $organizationId) {
       __typename
-      ...DocumentSignatureList_peopleFragment @arguments(filter: { contractEnded: false })
+      ...DocumentSignatureList_peopleFragment @arguments(filter: { contractEnded: false, state: ACTIVE })
     }
     # We use this on /documents/:documentId
     document: node(id: $documentId) @skip(if: $versionSpecified) {