Fix auth bypasses, race condition, stale connections, and unbounded query

- Block disabled accounts at login and unimpersonate (C4, C2)
- Catch IntegrityError on register commit to return 409 instead of 500 (C5)
- Stop _seed_admin from overwriting existing admin password on restart (C8)
- Cap public/stats query at 500 users to bound memory usage (C3)
- Rate-limit PUT /me/password at 5/minute (C6)
- Bump SQLAlchemy to 2.0.50 and aiomysql to 0.3.2; re-enable pool_pre_ping (C7)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/routers/admin.py

@@ -140,7 +140,7 @@ async def unimpersonate(
 
     result = await db.execute(select(User).where(User.id == admin_id))
     admin = result.scalar_one_or_none()
-    if not admin or not admin.is_admin:
+    if not admin or not admin.is_admin or admin.is_disabled:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin not found")
 
     return Token(access_token=create_token(admin.id))