Update community access when subscription status changes

Your candidate and contractor community access can go out of sync when subscription status changes. Keep access aligned with paid status so HR can finish onboarding or revoke access same day.