@actual-app/sync-server: Disabled users retain valid session tokens in OpenID multi-user mode

In OpenID multi-user mode, disabling a user does not invalidate existing session tokens, allowing continued authenticated access.

All deployments of @actual-app/sync-server using OpenID multi-user mode, especially those with default token expiration ('never').

Apply the fix that checks user enabled status during session validation and revokes sessions on user disable.