Warnings
Suspended/banned status not enforced at login
users.status can be set in admin but auth_attempt_login does not check it.
Severity: high Verified from source
Evidence
Traced during VibeKB initialization of Arcana. Documented rather than fixed (application safety rule).