docs(ECR-013B): 启动 AccountLifecycle 契约定义

Human Start Authorization：UserStatus 状态机 Spec/BD/contract_diff；
禁止 coding，待 Approve + coding Start Authorization。

Co-authored-by: Cursor <cursoragent@cursor.com>

docs/CONTRACT_DIFF/ECR-013B.yaml

@@ -0,0 +1,50 @@
+ecr: ECR-013B
+capability: AccountLifecycle
+bounded_context: Identity_Profile
+parent: WAVE0-FROZEN
+predecessor: ECR-013A
+change:
+  type: additive
+breaking_change: false
+migration_required: true
+compatibility_notes: >
+  users.status already exists (default active).
+  Non-active users begin to be rejected by DeviceAuth/Bearer (behavior tightening).
+  New table account_state_transitions (append-only).
+  RBAC catalog additive: admin.users.status.write seeded to super_admin.
+
+entities:
+  - name: UserStatus
+    before:
+      fields: [status string on users]
+      notes: no enforced transitions
+    after:
+      values: [active, disabled, banned, suspended]
+      machine: enforced edges
+  - name: AccountStateTransition
+    before: null
+    after:
+      fields: [id, user_id, from_status, to_status, admin_id, reason, created_at]
+  - name: AdminPermission
+    before:
+      catalog_ref: ECR-013A
+    after:
+      catalog_additive:
+        - admin.users.status.write
+
+apis:
+  - method: POST
+    path: /api/v1/admin/users/{id}/status
+    change: added
+  - method: GET
+    path: /api/v1/admin/users/{id}/status-transitions
+    change: added
+
+security_impact:
+  - "C-end reject when User.status != active"
+  - "RequirePermission admin.users.status.write on POST status"
+  - "403 + AuditLog on deny"
+
+observability_impact:
+  - "AuditLog users.status.transition"
+  - "account_state_transitions append-only"