http: session/login reject disabled users; mid-session disable kicks immediately

internal/server/http/ui_handlers.go

@@ -66,6 +66,10 @@ func (s *Server) sessionUser(r *stdhttp.Request) (*ui.User, error) {
 		}
 		return nil, err
 	}
+	if u.DisabledAt != nil {
+		_ = s.deps.Store.DeleteSession(r.Context(), auth.HashToken(c.Value))
+		return nil, nil
+	}
 	return &ui.User{ID: u.ID, Username: u.Username, Role: string(u.Role)}, nil
 }