case 4725 - sessions end on password reset and login disabled, exact login route, default SuperUser limited when licensed

A password set by someone else (reset code, administrator) or a disabled
login replaces the user's session token and download key; changing one's
own password keeps the session. PasswordResetCodeExpire is cleared (was
DlKeyExpire). The token middleware exempts only the exact login and
notify/hello routes and refuses inactive users and users who may not log
in. With a purchased licence, notify/hello no longer offers the default
SuperUser login and a SuperUser with the default password may only change
it (SuperUserDefaultPasswordRoutes). F7, F8 and F9 fixed. Manual and
changelog updated.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/AyaNova/util/License.cs

@@ -459,6 +459,15 @@ namespace AyaNova.Core
             }
         }
 
+        /// <summary>
+        /// case 4725: a purchased licence, active or expired (not unlicensed, trial or revoked)
+        /// </summary>
+        internal static bool PurchasedLicense()
+        {
+            var status = _ActiveLicense?.Status;
+            return status == AyaNovaLicenseKey.LicenseStatus.ActivePurchased || status == AyaNovaLicenseKey.LicenseStatus.ExpiredPurchased;
+        }
+
         #endregion
 
         #region EULA consent