Sub-ticket of PLUTO-149 SECURITY: isActive=false students NOT blocked — auth/callback + render path lack isActive gate; disabled+roled user with live session loads app · pluto