feat(profile,account): filter profiles by account status, block disabled accounts on signin
Admin profile list (GET /api/v1/profile) ignored account status, so disabled clients still showed up. Add status query param backed by a new cross-module IAccountStatusPort, and reject signin for accounts that are not ACTIVE.