security(07.2-03): add import time + user_nbf write to admin deactivation handler; promote stubs to PASSED

backend/api/admin.py

@@ -23,10 +23,12 @@ Security invariants:
 """
 from __future__ import annotations
 
+import time
 import uuid
 from datetime import datetime
 from typing import Optional
 
+from config import settings
 from fastapi import APIRouter, Depends, HTTPException, Request, status
 from pydantic import BaseModel, ConfigDict, EmailStr, Field, field_validator
 from sqlalchemy import func, select, update
@@ -351,6 +353,12 @@ async def update_user_status(
     if not body.is_active:
         # Revoke all refresh tokens on deactivation
         await revoke_all_refresh_tokens(session, user.id)
+        # Revoke any pre-deactivation access tokens still within their TTL (T-7.2-01)
+        await request.app.state.redis.set(
+            f"user_nbf:{user.id}",
+            int(time.time()),
+            ex=settings.access_token_expire_minutes * 60,
+        )
 
     session.add(user)