Replace user deletion with deactivation

Deactivation adds the alumni role and leaves the others in place, so
reactivation is lossless and nobody has to remember what an account held.
login_from_session checks alumni? on every request, so a signed-in user is
locked out on their next one without any session invalidation. Guards
prevent deactivating yourself or the last active admin, and both verbs are
witnessed in the action log.

1 files changed, 3 insertions, 2 deletions

diff --git a/app/models/node_action.rb b/app/models/node_action.rb
index fec5a062..d619aac5 100644
--- a/app/models/node_action.rb
+++ b/app/models/node_action.rb
@@ -98,8 +98,9 @@ class NodeAction < ApplicationRecord
   #   "detached_from"         -- array of unique_names, only when any
   #   "headline_removed_from" -- array of unique_names, only when any
   #
-  # "otp_enroll" / "otp_disable" / "otp_reset" (second-factor lifecycle;
-  # node column nil; participants: the affected User -- the table's first
+  # "otp_enroll" / "otp_disable" / "otp_reset" / "user_deactivate" /
+  # "user_reactivate" (second-factor lifecycle; node column nil;
+  # participants: the affected User
   # User-typed subject. otp_disable is self-service; otp_reset is an
   # administrator clearing someone else's factor, where actor and
   # participant differ):