[theMasix]

Closes #5

Summary

Users whose accounts were auto-disabled for missing the email verification window previously had no recourse other than contacting an admin. This MR adds a fully self-service reactivation flow so users can recover their accounts without support intervention.

What changed

• ExpireUserTrait — stamps a pp_disabled=1 flag when disabling a user, so we can distinguish PP-disabled accounts from admin-disabled ones.
• ReactivateController — new public controller with two endpoints:
  • GET /reactivate — renders the reactivation form.
  • POST /reactivate — re-enables the account, resets the verification deadline, and sends a fresh verification email. Always returns the same response regardless of whether the email matched an account, preventing email enumeration.
• VerifyMailHelper — replaces the static "contact your provider" text in the account-disabled email with a "Reactivate your account" CTA button linking to the new form.
• templates/reactivate-public.php — guest-layout template with two states: the email input form and a post-submission confirmation.
• appinfo/routes.php — registers the two new public routes.

Security notes

• The POST handler deliberately does not distinguish between "email not found" and "account found and reactivated" — the response is always the same to prevent account enumeration.
• Only accounts flagged with pp_disabled=1 (i.e., auto-disabled by this app) can be reactivated through this flow; admin-disabled accounts are unaffected.
• Re-enables the account and resets disable_user_after to the standard verification window before sending the new verification email.

[skjnldsv]

Thanks for this @theMasix