Fix/auth login account status validation

[rabsqueen]

🎯 Overview

closes #1039
closes #1042

Fixes an security asymmetry between AuthService.login() and AuthService.refreshTokens():

• Previously, login() bypassed the UserStatus.ACTIVE check, allowing non-active (suspended, banned, or soft-deleted) accounts to acquire fresh token pairs.
• Centralized account status assertion into a single assertUserMayAuthenticate(user) method called across login(), refreshTokens(), and strategy verifications (src/auth/strategies/).

---

🛠️ Key Architectural Changes

1. Centralized Helper (src/auth/auth.service.ts)

• Implemented assertUserMayAuthenticate(user: User) throwing UnauthorizedException('User is not active').
• Added explicit assertion call inside login() prior to invoking generateTokens().

2. Strategy Alignment (src/auth/strategies/)

• Updated Passport strategy handlers to evaluate assertUserMayAuthenticate prior to returning validated user entities.

---

🧪 Testing & Verification

npm run test src/auth/auth.service.spec.ts

[drips-wave]

@rabsqueen Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits