Audit_Firm_v2.0.3.4 — Phase 4: User Lifecycle Controls

Included in this phase:

user lifecycle fields: allow_login, is_locked, locked_at_utc, deleted_at
lifecycle helpers for activate/deactivate, login enable/disable, lock/unlock, soft delete/restore
UI lifecycle actions on the user management screen
API lifecycle endpoints for the same actions
audit logging for lifecycle actions
startup guard to add missing lifecycle columns on existing databases
auth/session checks updated to respect login-disabled, locked, and soft-deleted users