feat(07-07): replay the 15 user-api routes and both nuxt auth flows

Match PHP payloads, already-activated Winter 500 HTML, and direct-DB
seeding so the corpus can flip those routes to ported without onboarding.

Co-authored-by: Cursor <cursoragent@cursor.com>

classes/codes.go

@@ -144,11 +144,24 @@ func VerifyActivationCode(ctx context.Context, db *gorm.DB, userID uint, code st
 	return user, true
 }
 
+// IsAlreadyActivated reports whether the scoped user row is activated.
+// A missing user is (false, nil); a real DB error is (false, err).
+func IsAlreadyActivated(ctx context.Context, db *gorm.DB, userID uint) (bool, error) {
+	user, err := takeUser(ctx, db, userID, false)
+	if err != nil {
+		return false, err
+	}
+	if user == nil {
+		return false, nil
+	}
+	return user.IsActivated, nil
+}
+
 func takeUser(ctx context.Context, db *gorm.DB, id uint, unscoped bool) (*models.User, error) {
 	if db == nil || id == 0 {
 		return nil, nil
 	}
-	q := db.WithContext(ctx)
+	q := db.Session(&gorm.Session{NewDB: true, Context: ctx})
 	if unscoped {
 		q = q.Unscoped()
 	}