🛂(backend) do not duplicate user when disabled

Purpose

When a user is disabled and tries to login, we don't want the user to be duplicated, the user should not be able to login.

[x] look for existing user with the same sub (or fallback on email) even if disabled
[x] do not allow login for disabled users