▣ wi

Sub-item of #1164 SECURITY: isActive=false students NOT blocked — auth/callback + render path lack isActive gate; disabled+roled user with live session loads app · pluto