feat(auth): block disabled user accounts at the subscription guard

RequireActiveTenantSubscription now optionally takes an AuthRepository
and rejects the request with 40311/user_disabled when the actor's user
row is anything other than active. Wire the repo through the tenant
router, surface the new error code in admin-web's
membershipBlockedErrors set, persist a "disabled" membership status when
markStoredMembershipBlocked sees user_disabled, and add localized copy
on the blocked screen and shell membership banner.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/admin-web/src/views/MembershipBlockedView.vue

@@ -16,6 +16,8 @@ const stillBlocked = ref(false);
 
 const blockedReasonText = computed(() => {
   switch (membership.value?.blocked_reason) {
+    case "user_disabled":
+      return t("membershipBlocked.reasonUserDisabled");
     case "trial_plan_expired":
       return t("membershipBlocked.reasonTrialExpired");
     case "subscription_required":