ADMIN-OPS-001 — soft-disable an account (blocks login + hides their agents)

Soft-disable an account: set is_active=False and hide their public agents.

Enforcement of the disabled state is ALREADY wired in routers/auth.py: a disabled account's password login is rejected (403 "inactive") AND their existing session is rejected on the next request (get_current_user → 401), so no token needs to be individually revoked here.

Side effect: every one of the account's currently-public agents is flipped to is_public=False so a disabled user's work leaves the public Talent Pool / Compare / Registry immediately. Enable does NOT auto-republish them (see the enable endpoint) — re-publishing is a deliberate per-agent choice.

Idempotent: re-disabling an already-disabled account returns 200 with changed=false (and still re-hides any agents that drifted public).

Guard: an admin cannot disable THEMSELVES (400) — that would lock the operator out of the very surface they're using.

Auth: anonymous → 401, non-admin → 403, admin → 200. Flag-off → 404.