86f9f5f9b1
- reset_password sets is_active=True so users with unverified accounts can log in after using the forgot-password flow - admin set_password also sets is_active=True for the same reason - auth() now checks is_active before verifying the password, ensuring inactive users always see the email-verification prompt regardless of password correctness (avoids leaking password validity)" Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>