Deactivate (or restore) portal access. username scopes it to one account; omitting it applies to the whole health system.

Both hs_portal_users.active and health_systems.active existed from the first build and nothing ever wrote them — they were columns for a revocation path that did not exist. require_hs_portal already rejects an inactive account on every request, so flipping the flag ends live sessions too.