feat: admin suspend/activate user account (#58)

[MarcusDavidG]

Summary

Closes #58

Changes

• User model: Added status field with enum ['active', 'suspended'], defaulting to 'active'
• Login: Suspended users are blocked at login with a 403 and message: "Your account has been suspended. Please contact support."
• New endpoint: PATCH /api/admin/users/:id/status — requires admin role, accepts { status: 'active' | 'suspended' }
• Tests: 7 tests covering suspend, reactivate, invalid status, 404, self-status change prevention, auth guard, and suspended login

Endpoint

PATCH /api/admin/users/:id/status
Authorization: Bearer <admin-token>
Body: { "status": "suspended" | "active" }

Acceptance Criteria

• Suspended users cannot log in and receive 403 with a clear message
• Admins can suspend or reactivate any user except themselves
• Endpoint is protected by admin role middleware

[ayshadogo]

Thank you for your contribution 🤝