v2.11.1: fix(auth): Decouple login blocked status from unblock time determination

The decision to refuse a sign-in must not depend on whether the unblock moment could also be worked out. Previously, `isBlocked()` relied on `blockedUntil` being non-null, which could lead to a "fail-open" vulnerability if the time calculation (a separate query) failed.

This change introduces a dedicated `blocked` boolean flag to ensure the throttling decision is robust and independent, preventing unintended access even if the exact unblock time cannot be determined.