fix(api): op-login finish 拒绝审批后被停用或删除的账号

docs/openapi.yaml

@@ -3300,8 +3300,9 @@ paths:
         Public, pre-session final leg: mints a host-only staff session only when BOTH
         factors have landed — the request is approved-and-live AND the mailed code
         verifies. Every failure (unknown handle, not-yet-approved, wrong or locked code,
-        an account past its daily wrong-code budget, lost race) collapses into one uniform 400 op_login_invalid, so a code-less
-        caller learns nothing. Admin is re-asserted before the session is issued.
+        an account past its daily wrong-code budget, an account disabled or deleted since
+        the start, lost race) collapses into one uniform 400 op_login_invalid, so a
+        code-less caller learns nothing. Admin is re-asserted before the session is issued.
       x-felis-face: [external]
       x-felis-tier: public
       security: []
@@ -3329,8 +3330,9 @@ paths:
         '400':
           description: >-
             request_id and code are required (bad_request); or the login could not be
-            completed — unknown handle, not approved, wrong or locked code, or lost
-            race, all uniform (op_login_invalid).
+            completed — unknown handle, not approved, wrong or locked code, an account
+            disabled or deleted since the start, or lost race, all uniform
+            (op_login_invalid).
           content:
             application/json:
               schema: { $ref: '#/components/schemas/Error' }