Revoke former employee accounts before next billing run

Your deactivation requests arrive by webhook, leaving stale accounts and compliance gaps that risk license costs and data exposure. Security and HR get revoked status propagated so accounts close before the next billing run.