End a user's sessions when the account is deactivated

There is no token denylist in this product, so the JWT user loader is
the only place a deactivated account can be stopped, and it did a bare
lookup by id. Somebody deactivated at 09:00 kept a working access token
until it expired, and a refresh token that minted fresh ones for thirty
days.

/api/auth/refresh and the API-token path already checked isactive. This
makes the loader consistent with them rather than inventing policy.

Scope: product

CHANGELOG.md

@@ -147,6 +147,13 @@ ADR-007 and ADR-002.
   `applications.download` permission, which is not grantable, so the catalogue
   metadata can still be opened to a site's floor without the bytes going with it.
 
+- **Deactivating an account did not end its sessions.** There is no token
+  denylist in this product, so the JWT user loader is the only place a
+  deactivated account can be stopped, and it did a bare lookup by id. Somebody
+  deactivated at 09:00 kept a working access token until it expired and a
+  refresh token that minted new ones for thirty days. `/api/auth/refresh` and
+  the API-token path already checked `isactive`; the loader now does too.
+
 - **The published site's API documentation page had no spec to show.**
   `shopdb/core/api/docs.py` reads `docs/openapi.json` at runtime to serve
   `/api/docs`, and publication excluded the whole of `docs/` because the prose