fix: exclude withdrawn/cancelled requests from duplicate check

[rmcew]

Summary

• When multipleRequestsPerPeriod is false, the duplicate request guard in reasonMayNotCreateInPeriodForUser was querying all requests for the user in the period — including withdrawn and cancelled ones
• This prevented users from submitting a new request after withdrawing a previous one
• Fix passes status filter to find() to exclude WITHDRAWN and CANCELLED at the query level

Test plan

• Configure an app with multipleRequestsPerPeriod: false
• Submit a request, then withdraw it
• Verify a new request can be created in the same period
• Verify that a second active request is still blocked

[wickning1]

We have the ability to re-open requests, so the thinking was that we'd prefer a request get re-opened rather than re-created. This is especially true for WITHDRAWN, where reviewers could get confused or perceive that the system lost their work if an applicant withdraws and recreates after the reviewer has started. We figured reviewers would rather take a support request and re-open it manually and send it back.

If we went this route instead, we would also need to put a block on re-opening when there is a valid request in the same period.

[rmcew]

Thanks for the response, and the insight. This is why I made a PR instead of just pushing commits while I'm still learning the framework

I glazed over the fact that applicants can unwithdraw an app themselves. However, it looks like the UI code for that is currently commented out:
https://github.com/txstate-etc/reqquest/blob/main/ui/src/routes/dashboards/applicant/%2Bpage.svelte#L151

[rmcew]

I guess the next question is, is there a reason that UI code is disabled?

[wickning1]

I think it just wasn't fully baked and we were trying to focus our efforts. Certainly eligible to get implemented for 1.1.