Add user approval and suspension workflow

[OlivierJM]

Feature Parity: User Approval & Suspension

Legacy app has a user status system (pending/active/suspended) with admin-controlled approval; sparked-next has no concept of user status beyond role assignment.

Legacy capabilities

• New users start with status: 0 (pending) — cannot access content until approved
• Admin approves users → status: 1 (active)
• Admin can suspend users → status: 2 (suspended) — revokes access without deleting account
• Admin can reinstate suspended users
• User list shows status with visual indicator
• Pending users shown as a queue for admin action

Why this matters

Without approval workflow, any self-registered user immediately has full access. In institutional settings, this is a security/control concern.

Acceptance criteria

• Add status field to users collection: pending | active | suspended
• New self-registered users default to pending (or active if configured — make it config-driven)
• PUT /api/admin/users/:id/status — update user status (admin only)
• Admin user list shows status badge per user
• Pending users queue/filter in admin UI
• Suspended users cannot login / receive 403 response
• Config flag: requireApproval (if false, users activate immediately on signup)

Identified via feature-parity audit against legacy Sparked (Meteor) app.