feat(ECR-013B): AccountLifecycle Closed；启用 Loop 连续执行

UserStatus 迁移、DeviceAuth 拒绝非 active、admin-h5 CTA；
Reviewer Closed。Human 授权 LOOP_AUTHORIZATION（免逐闸确认）。

Co-authored-by: Cursor <cursoragent@cursor.com>

proto/openapi.yaml

@@ -195,6 +195,53 @@ paths:
         '200':
           description: OK
 
+  /api/v1/admin/users/{id}/status:
+    post:
+      tags: [admin]
+      summary: Transition UserStatus
+      description: Requires admin.users.status.write; writes transition + AuditLog
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { type: string, format: uuid }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [status, reason]
+              properties:
+                status: { type: string, enum: [active, disabled, banned, suspended] }
+                reason: { type: string }
+      responses:
+        '200':
+          description: OK
+        '400':
+          description: Invalid edge or missing reason
+        '403':
+          description: Forbidden
+
+  /api/v1/admin/users/{id}/status-transitions:
+    get:
+      tags: [admin]
+      summary: List UserStatus transitions
+      description: Requires admin.users.read
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { type: string, format: uuid }
+        - in: query
+          name: limit
+          schema: { type: integer }
+      responses:
+        '200':
+          description: OK
+        '401':
+          description: Unauthorized
+
   /api/v1/admin/orders:
     get:
       tags: [admin]