Check active users before cluster login fallback

[bbliem]

Mirror the Kausal Watch login behavior by treating only active local accounts as local matches before trying configured regional backends. This lets users with inactive stale accounts in the current deployment still be redirected to the cluster where their active account lives.

Add focused admin login tests for remote-cluster redirects, inactive local account fallback, local-user precedence, and the guard that avoids peer checks when the current host is already a regional endpoint.

Note that, contrary to our assumption, most of the functionality for redirecting users was already in place in this repo.

---

✅ Pre-Merge Checklist

Type of Change

• Set the PR's label to match the nature of this change

Testing

• Built Unit tests (unit tests added/updated)
• Built E2E tests (if applicable. E2E tests added/updated)
• Authorization is tested (permissions and access controls verified)
• Manually tested locally (functionality verified)

  Manual testing instructions

  If feature requires manual testing by reviewer, you can provide instructions here.

Internationalization & Accessibility

• New strings are translatable (all user-facing text uses i18n)
• Accessibility standards met (WCAG compliance, screen reader support)

Dependencies

• Dependencies are merged (if applicable. If the change depends on other PRs e.g. kausal_common)

---

Screenshots/Videos (if applicable)

Add screenshots or videos demonstrating the changes if applicable.

Additional Notes

Any additional information that reviewers should know about this PR.