fix(auth): activate account on password reset and fix is_active check order

- reset_password sets is_active=True so users with unverified accounts
  can log in after using the forgot-password flow
- admin set_password also sets is_active=True for the same reason
- auth() now checks is_active before verifying the password, ensuring
  inactive users always see the email-verification prompt regardless of
  password correctness (avoids leaking password validity)"

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/api/local_auth.py

@@ -366,6 +366,9 @@ async def reset_password(body: PasswordResetBody, db: DbSession) -> dict[str, st
     user.hashed_password = hash_password(body.new_password)
     user.password_reset_token = None
     user.password_reset_sent_at = None
+    # Activate the account in case it was still pending email verification.
+    # A valid password-reset token proves control of the registered email address.
+    user.is_active = True
     db.commit()
 
     logger.info("[SECURITY] PASSWORD_RESET_SUCCESS user=%s", user.email)