No token revocation on deactivate - that would force users to regenerate tokens on reactivation, which admins probably don't want. Middleware refusal is enough because it fires on every request.
