feat(world): add persistent citizen simulation with needs, jobs, and social features

- Adds Character model with survival needs (hunger, thirst, energy) and state machine
- Implements city:tick world ticker for offline progression every minute
- Adds city territory expansion and building construction system
- Introduces job economy, inventory, and transaction audit trail
- Adds social graph (friends, marriage, children) and character chat
- Implements admin approval workflow for new registrations
- Adds hospital admission system for traffic accidents
- Includes comprehensive feature tests and world seeders

app/Http/Middleware/EnsureUserIsActive.php

@@ -2,15 +2,16 @@
 
 namespace App\Http\Middleware;
 
+use App\Models\User;
 use Closure;
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
 
 /**
- * Ensures the authenticated account is still active.
+ * Ensures the authenticated account is still active and approved.
  *
- * Blocks disabled (deactivated) accounts from accessing any protected
- * route, even when a previously issued token or session remains valid.
+ * Blocks banned/disabled accounts and routes pending registrations to the
+ * approval wait screen, even when a previously issued token or session remains.
  */
 class EnsureUserIsActive
 {
@@ -23,13 +24,23 @@ class EnsureUserIsActive
     {
         $user = $request->user();
 
-        if ($user !== null && ! $user->is_active) {
+        if ($user !== null && $user->status !== User::STATUS_ACTIVE) {
             if ($request->expectsJson()) {
                 return response()->json([
-                    'message' => __('auth.disabled'),
+                    'message' => $user->status === User::STATUS_PENDING
+                        ? __('auth.pending')
+                        : __('auth.disabled'),
                 ], 403);
             }
 
+            if ($user->status === User::STATUS_PENDING) {
+                if ($request->routeIs('account.pending', 'terms.accept', 'terms.accept.store', 'logout')) {
+                    return $next($request);
+                }
+
+                return redirect()->route('account.pending');
+            }
+
             auth()->guard('web')->logout();
             $request->session()->invalidate();
             $request->session()->regenerateToken();