fix(security): isActive defense-in-depth, MIME magic bytes upload, tenantId=origins OAuth

backend/src/middleware/auth.middleware.ts

@@ -64,6 +64,11 @@ export const requireAuth = async (
       return;
     }
 
+    if (!data.data.user.isActive) {
+      res.status(401).json({ success: false, error: "ACCOUNT_DISABLED", message: "Account is disabled" });
+      return;
+    }
+
     (req as AuthenticatedRequest).user = data.data.user;
     next();
   } catch (err) {