[PR #783] fix(auth): reconcile tenant user deletion

Release Notes

Summary

Workspace administrators can remove users more reliably,
including users who have not yet completed sign-in. Removed or
uninvited users are now blocked from signing in to the workspace,
even if their identity provider membership is restored during
login.

Changes

• Removing a user from a workspace now cancels outstanding
  invitations, removes organization membership, and deletes local
  account records together.
• Users pending invitation or activation can be removed without
  requiring a stored identity provider account ID.
• Sign-in now verifies workspace authorization after login. Users
  without valid workspace access are denied and removed from the
  workspace organization.

Impact

Security/audit impact: Removed users can no longer regain workspace
access through restored identity provider membership. Workspace
administrators should see more consistent removal outcomes.
Invitation-based new user signup is unchanged.

Classification

Auth, Security, Admin, Tenant Workflow, Bug Fix, Audit / Logging

Source: cursor-automation | PR: https://github.com/EpykLab/stllr/pull/783 | Merged: 2026-07-14