Decision sorb. mas-cli locked the account and killed one OAuth and two browser
sessions, so signing in is no longer possible. deactivated_at stays empty though:
lucky now sits where scanner-test sits, not where @bojeledoggo does.
This MAS version's CLI has no deactivate-user - only lock/unlock. Full deactivation
runs through the admin API or Element Admin and therefore through an admin token,
which does not belong in a session. Locking takes the effect forward until sorb
makes it final with a click.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>