Reinvite an excluded user whose Cognito login was purged

Re-onboards an excluded (ativo=0) user whose Cognito account was hard-deleted by the dormant-cleanup cron. Creates a fresh Cognito user (sending the setup email), rewrites the Z_Users + Utilizadores cognito_sub, and reactivates the existing row — optionally at a new point of sale / role (a rehire may land at a different loja).

The existing row is REUSED (never re-inserted) because cognito_sub / Z_Users.email / Z_Users.cognitosub are all UNIQUE. Reactivating + relinking BEFORE first login means auth joins cleanly on the new sub and the fragile auto-create/claim path is never taken.

Restricted to the company's OWN admin (not system_admin) — same gate as reactivation.