[DJAngel973]

Summary

This PR strengthens authorization and account lifecycle controls for the wallet API.

Account authorization

• Only ADMIN users can deactivate accounts.
• Added PATCH /users/{id}/deactivate.
• Removed self-service account deactivation.
• Removed DELETE-based account removal behavior.
• Account data is retained; only isActive is changed.
• All active sessions are revoked after deactivation.
• ADMIN accounts cannot be deactivated through this management route.
• Public registration always persists the USER role.

Auditability

• Replaced the misleading USER_DELETE audit action with ACCOUNT_DEACTIVATE.
• Audit records preserve:
  • administrator actor;
  • affected user;
  • operation result.
• Account deactivation auditing participates in the same transaction as the state change.
• Wallet lifecycle audits now record the real administrator as the actor.

Wallet authorization

• Wallet ownership is always derived from the authenticated JWT.
• Users cannot access wallets belonging to another user.
• Ownership mismatches return non-enumerating 404 responses.
• Administrative wallet lifecycle operations require ROLE_ADMIN.

Database

• Added the ACCOUNT_DEACTIVATE PostgreSQL enum value.
• Applied database/08-migrations.sql.
• Existing refresh-token storage structures remain removed.
• Failed-login counter constraint remains aligned with the five-attempt policy.

Security considerations

• OWASP A01: Broken Access Control — ADMIN-only management operations and JWT-derived ownership.
• OWASP A07: Identification and Authentication Failures — session revocation after account deactivation.
• OWASP A09: Security Logging and Monitoring Failures — immutable actor/target audit evidence.
• No user, wallet, transaction or audit data is physically deleted.