feat(users): add ability to disable users without deleting them

- Add disabled boolean field to user schema (PostgreSQL, MySQL, SQLite)
- Block disabled users from logging in via any auth provider (credentials, LDAP, OIDC)
- Check disabled status in session callback to prevent session replay
- Add changeDisabled API endpoint (admin-only)
- Include disabled field in getById and getAll user endpoints
- Add disable/enable user toggle in admin UI with status badge in user list

packages/api/src/router/user.ts

@@ -232,6 +232,7 @@ export const userRouter = createTRPCRouter({
           email: true,
           emailVerified: true,
           image: true,
+          disabled: true,
         }),
       ),
     )
@@ -252,6 +253,7 @@ export const userRouter = createTRPCRouter({
           email: true,
           emailVerified: true,
           image: true,
+          disabled: true,
         },
       });
     }),
@@ -341,6 +343,7 @@ export const userRouter = createTRPCRouter({
         emailVerified: true,
         image: true,
         provider: true,
+        disabled: true,
         homeBoardId: true,
         mobileHomeBoardId: true,
         firstDayOfWeek: true,
@@ -377,6 +380,7 @@ export const userRouter = createTRPCRouter({
           emailVerified: true,
           image: true,
           provider: true,
+          disabled: true,
           homeBoardId: true,
           mobileHomeBoardId: true,
           firstDayOfWeek: true,
@@ -777,6 +781,23 @@ export const userRouter = createTRPCRouter({
       completedBoardTour: user?.completedBoardTour ?? false,
     };
   }),
+  changeDisabled: permissionRequiredProcedure
+    .requiresPermission("admin")
+    .input(
+      z.object({
+        userId: z.string(),
+        disabled: z.boolean(),
+      }),
+    )
+    .output(z.void())
+    .mutation(async ({ input, ctx }) => {
+      await ctx.db
+        .update(users)
+        .set({
+          disabled: input.disabled,
+        })
+        .where(eq(users.id, input.userId));
+    }),
 });
 
 const createUserAsync = async (db: Database, input: Omit<z.infer<typeof userBaseCreateSchema>, "groupIds">) => {