feat(ECR-013B): AccountLifecycle Closed；启用 Loop 连续执行

UserStatus 迁移、DeviceAuth 拒绝非 active、admin-h5 CTA；
Reviewer Closed。Human 授权 LOOP_AUTHORIZATION（免逐闸确认）。

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/TEST_REPORT/ECR-013B.md

@@ -0,0 +1,45 @@
+# TEST_REPORT — ECR-013B AccountLifecycle
+
+Date: 2026-08-07  
+ECR: ECR-013B · BD-2026-013B  
+Parent: WAVE0-FROZEN · Predecessor: ECR-013A Closed
+
+## Commands
+
+```bash
+export PATH="$HOME/.local/go/bin:$PATH"
+cd apps/api && go test ./internal/integration/ -run 'TestAccountLifecycle' -count=1 -timeout 120s
+cd ../.. && npm run build:admin
+python3 scripts/ess-validate.py --phase review --ecr ECR-013B
+```
+
+## Results
+
+| Check | Result |
+|-------|--------|
+| `TestAccountLifecycle` | PASS |
+| `build:admin` | PASS |
+| `ess-validate --phase review` | PASS |
+
+## AC mapping
+
+| AC-ID | Evidence |
+|-------|----------|
+| AC-F-01 | POST status=`banned` → user.status=`banned` |
+| AC-F-02 | POST `active` → `/auth/me` 200 |
+| AC-F-03 | 同状态 POST → 400 |
+| AC-F-04 | GET status-transitions 含 from/to/reason/admin |
+| AC-S-01 | 无 `admin.users.status.write` → 403 |
+| AC-S-02 | banned Bearer → `/auth/me` 401 |
+| AC-S-03 | 无 Admin POST status → 401 |
+| AC-S-04 | 无 Admin GET transitions → 401 |
+| AC-P-01 | GET transitions < 500ms |
+| AC-O-01 | AuditLog `users.status.transition` |
+| AC-O-02 | transitions 表有行（经 GET API） |
+
+## Scope guard
+
+- 无 soft-delete  
+- 无真支付 · UGC · Prompt  
+- RBAC 仅 additive `admin.users.status.write`  
+- Migration `000016_account_lifecycle`