Create inactive access record for deactivated user role

Deactivated roles often remain active and lack audit history, forcing IT into manual revocations. This creates an archived inactive record and archives the original so admins can revoke access quickly.