Remove access for cancelled students before billing run

Your course cancellation webhooks arrive unfiltered, causing continued access and renewal revenue leakage. Membership managers stop improper entitlements and protect renewal revenue before the next billing run.