Re-enable a previously disabled customer user

Clears `disabled_at` so the user can log in again. Sessions + API keys are NOT auto-restored — those were intentionally revoked at disable-time and must be re-minted by the user (login) or admin (key creation).