[Audit][P1] Consolidate account verification and activation state

## Context

Account verification is enforced without a migration for existing users, while a second legacy account-status system remains active. The two paths use different metadata and activation formats.

Audit findings: 6, 7, 10, and 14.

## Scope

- Define one authoritative account state and activation flow.
- Migrate or safely grandfather existing users before enforcement.
- Remove the legacy `key`/`user_id`, `account_status`, and hardcoded `wp_users` path.
- Make login, session, social-auth, and API behavior consistent.

## Done when

- Existing legitimate and privileged users are not locked out.
- New unverified accounts are handled consistently.
- Activation tokens are validated before state changes.
- Login, REST, XML-RPC, and application-password behavior has integration coverage.