[DJAngel973]

Summary

Implements SEC-006: existing access tokens can no longer authenticate users whose accounts are disabled or temporarily locked.

Changes

• JwtAuthFilter now checks the reloaded account state before creating the SecurityContext.
• A valid JWT is rejected when the account is disabled or locked.
• Account deactivation now revokes all active refresh sessions.
• Added unit tests for disabled, locked, and active/unlocked JWT authentication states.
• Updated deactivation tests to verify refresh-session revocation.
• Updated SEC-006 verification status in IMPLEMENTATION-PLAN.md.

Security

• OWASP A07: JWT signature validity does not by itself prove the account remains authorized.
• OWASP A01: protected endpoints receive no authenticated principal for disabled or locked accounts.
• OWASP A09: account deactivation remains audited.
• Disabled accounts cannot use existing access tokens or obtain new ones through existing refresh sessions.