Tighten Authorization Guards And Revoke Departed Reviewers

[b-at-neu]

Barebones — not scoped yet. Waits on the auth system.

Access today is coarse: isAdmin on User, plus manager access derived from Position.managers rows. There is no notion of access expiring. A reviewer who graduates, leaves the SGA, or rotates off a committee keeps their access until someone remembers to remove them by hand — and nothing prompts anyone to remember.

Idea: tighter, time-aware guards on who counts as an authenticated, authorized user at any given moment, and a path for revoking a departed reviewer that doesn't depend on someone noticing.

Deliberately parked — this should follow whatever direction the auth system takes rather than front-run it.

Open questions for scoping:

• What signals that someone left? A term end date, an SSO/directory signal, an inactivity threshold, a manual offboarding step?
• Does access expire automatically, or get flagged for an admin to confirm? Automatic revocation that misfires locks out a working reviewer mid-cycle.
• What happens to positions whose last manager is revoked? Today a position with no managers can't be edited by a non-admin, so this can orphan a position.
• Does deactivateUser already cover part of this, and if so what's actually missing?
• Are sessions revoked immediately, or at next sign-in? Better Auth sessions live in the Session table.