Let a client account expire on a date

Staff can give a client an expiry date on the create and edit screens,
and through /api/v1/clients. When the date passes, the client is refused
at sign-in and on their next request, and their API access ends too.
Files and history stay, and a later date (or none) brings them back.

Access is checked through one predicate, User::maySignIn(), at every
door: sign-in, the web session, API tokens and the two-factor
challenge. An hourly sweep also switches `active` off, so the list,
its filter and seat counts agree. The sweep is not what enforces it,
so a scheduler that is not running cannot keep an account open.

An account cannot be active with a date that has passed. Reactivating
an expired client needs a new date in the same save.

The day-means-end-of-day-where-you-are rule moved out of FileExpiry
into a shared DateInput, so file and account expiry read dates the
same way.

Requested by @Drardollan in #1310.

app/Modules/Identity/Http/Controllers/TwoFactorChallengeController.php

@@ -90,6 +90,6 @@ class TwoFactorChallengeController extends Controller
 
         $user = User::query()->find($id);
 
-        return $user instanceof User && $user->active && $user->hasTwoFactorEnabled() ? $user : null;
+        return $user instanceof User && $user->maySignIn() && $user->hasTwoFactorEnabled() ? $user : null;
     }
 }