feat(ECR-013B): AccountLifecycle Closed；启用 Loop 连续执行

UserStatus 迁移、DeviceAuth 拒绝非 active、admin-h5 CTA；
Reviewer Closed。Human 授权 LOOP_AUTHORIZATION（免逐闸确认）。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/migrations/000016_account_lifecycle.down.sql

@@ -0,0 +1,3 @@
+DROP INDEX IF EXISTS idx_account_state_transitions_user;
+DROP TABLE IF EXISTS account_state_transitions;
+DELETE FROM admin_role_permissions WHERE code = 'admin.users.status.write';

apps/api/migrations/000016_account_lifecycle.up.sql

@@ -0,0 +1,20 @@
+-- ECR-013B AccountLifecycle / UserStatus
+
+CREATE TABLE IF NOT EXISTS account_state_transitions (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  user_id uuid NOT NULL REFERENCES users(id),
+  from_status varchar(32) NOT NULL,
+  to_status varchar(32) NOT NULL,
+  admin_id uuid NOT NULL REFERENCES admin_accounts(id),
+  reason text NOT NULL DEFAULT '',
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE INDEX IF NOT EXISTS idx_account_state_transitions_user
+  ON account_state_transitions(user_id, created_at DESC);
+
+INSERT INTO admin_role_permissions(role_id, code)
+SELECT r.id, 'admin.users.status.write'
+FROM admin_roles r
+WHERE r.name = 'super_admin'
+ON CONFLICT DO NOTHING;