feat: UserChecker to gate login for pending and blocked users

[martinydeAI]

Tracked under ADR 004 (#60).

Block sign-in for any user whose status is not Approved by
implementing Symfony Security's UserCheckerInterface.

Scope

• App\Security\AccountStatusChecker implementing
  UserCheckerInterface::checkPreAuth():
  • Pending → throw CustomUserMessageAccountStatusException
    ("security.login.error.pending").
  • Blocked → throw CustomUserMessageAccountStatusException
    ("security.login.error.blocked").
  • Approved → no-op.
• Wire it on the main firewall in security.yaml via
  user_checker: App\Security\AccountStatusChecker.
• Add the two translation keys to translations/messages.da.yaml.
• Tests:
  • direct unit tests for each status branch
  • functional test for the login flow with a Pending user

Related

• ADR 004 (Decide on user registration, approval, and account-state model #60).
• feat: add User entity with active / domainManager / name fields #45 (User entity must expose status).
• User login #2 (login flow — this is the gate inside it).