Deactivating inactive accounts

## Security Story

### Story context

**AC-2(3)**

From security assessor:
> CDS should investigate if an access control feature could be implemented which would automatically disable accounts if they haven’t been used within an organizationally defined period of time.

There are three kinds of accounts we should consider:
- Client accounts
- CDS super admin accounts

### Timeline

By Q4 (March 2027)

### Acceptance criteria
- [ ] Determine which account types should be automatically disabled
- [ ] Decide period of time after which accounts are automatically deactivated
- [ ] Identify how clients can reactivate their account
- [ ] Write development tasking cards
- [ ] Update risk register, SA&A, and SRTM to reflect new risks and their treatments.
- [ ] Treatments are implemented or a new card is created.