Add menu enable toggle, user status, and mobile/UI polish

- Admin menu page: mobile item cards now put Actions in the top-right
  corner next to Status, matching the desktop row layout instead of
  stacking at the bottom; same treatment applied to announcements and
  users for consistency across all three admin lists
- Center button label text everywhere via .btn { justify-content: center }
  instead of one-off overrides
- Add a Disable/Enable Menu toggle to the admin menu toolbar; the public
  menu page shows its existing "menu being updated" message while disabled
- Add an Enabled/Disabled status to user accounts, with its own toggle
  badge, guardrails against disabling your own account or the last
  enabled account, and an immediate session kick for anyone disabled
  mid-session
- Fix the announcement banner / hero tagline "·" separators to hide only
  when their neighboring text actually wraps onto a different line,
  instead of a fixed breakpoint or always-on dot

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

inc/auth.php

@@ -25,6 +25,19 @@ function require_auth(): void {
         header('Location: login.php');
         exit;
     }
+
+    // A user disabled mid-session should lose access immediately rather
+    // than keep it until their session expires — re-check against the DB
+    // instead of trusting the session's now-possibly-stale copy.
+    $pdo = get_db();
+    $stmt = $pdo->prepare("SELECT is_enabled FROM users WHERE id = ?");
+    $stmt->execute([$_SESSION['admin_user_id']]);
+    $stillEnabled = $stmt->fetchColumn();
+    if ($stillEnabled === false || (int) $stillEnabled !== 1) {
+        logout_user();
+        header('Location: login.php');
+        exit;
+    }
 }
 
 function get_logged_in_user(): ?array {
@@ -44,7 +57,7 @@ function authenticate_user(string $username, string $password): bool {
     $stmt->execute([trim($username)]);
     $user = $stmt->fetch();
 
-    if ($user && password_verify($password, $user['password_hash'])) {
+    if ($user && (int) $user['is_enabled'] === 1 && password_verify($password, $user['password_hash'])) {
         session_regenerate_id(true);
         $_SESSION['admin_user_id'] = $user['id'];
         $_SESSION['admin_username'] = $user['username'];