serviceability: deprecate access-pass Expired status

[juan-malbeclabs]

Summary of Changes

• Deprecate the AccessPassStatus::Expired status: epoch expiry no longer demotes users to OutOfCredits. update_status stops producing the status, and both try_activate (user creation) and CheckUserAccessPass (periodic re-check) keep users Activated.
• Epoch validity remains enforced at user creation for unicast users only, via the extracted UserType::is_epoch_gated() / epoch_allows_connection() helpers. Multicast publishers and subscribers are governed by mgroup_*_allowlist, not by epoch.
• Rename the enum variant Expired → ExpiredDeprecated (discriminant 3 retained for wire compatibility) and render it as "expired (deprecated)", mirrored across the Go, Python, and TypeScript SDKs and the shared enum_strings.json fixture.
• Remove the client-side User not active precheck from the Rust SDK multicast subscribe/publish command so non-Activated users are no longer blocked before submission; authorization is enforced onchain.

Diff Breakdown

Category	Files	Lines (+/-)	Net
Core logic	5	+185 / -48	+137
Scaffolding	4	+15 / -10	+5
Tests	2	+12 / -8	+4
Docs	1	+6 / -0	+6
Total	12	+218 / -66	+152

Mostly a focused onchain behavior change; the large user.rs count is dominated by new inline unit tests, and the SDK/fixture edits are mechanical enum-mirror updates.

Key files (click to expand)

• smartcontract/programs/doublezero-serviceability/src/state/user.rs — add UserType::is_epoch_gated() and epoch_allows_connection(); simplify try_activate to always activate; add unit-test matrix
• smartcontract/programs/doublezero-serviceability/src/state/accesspass.rs — rename Expired → ExpiredDeprecated; update_status no longer derives status from last_access_epoch (drops Clock)
• smartcontract/programs/doublezero-serviceability/src/processors/user/check_access_pass.rs — drop the Expired → OutOfCredits branch; always Activated
• smartcontract/sdk/rs/src/commands/multicastgroup/subscribe.rs — remove the User not active precheck
• smartcontract/programs/doublezero-serviceability/src/processors/user/create_core.rs — creation gate now uses the shared epoch helpers (unicast-only, multicast exempt)
• smartcontract/sdk/go/serviceability/state.go — mirror the status rename (AccessPassStatusExpiredDeprecated)
• sdk/serviceability/python/serviceability/state.py — mirror the rename (EXPIRED_DEPRECATED)
• sdk/serviceability/typescript/serviceability/state.ts — mirror the "expired (deprecated)" string

Testing Verification

• Added unit tests in state/user.rs: test_epoch_allows_connection_matrix (IBRL with last_access_epoch = 0 blocked; multicast publisher/subscriber allowed without an epoch check; IBRLWithAllocatedIP/EdgeFiltering blocked; valid-epoch unicast allowed), test_user_type_is_epoch_gated, and test_try_activate_always_activates.
• Updated integration tests: multicast creation with last_access_epoch = 0 now asserts Activated; repurposed the prior delete-from-OutOfCredits test to confirm CheckUserAccessPass keeps an epoch-expired unicast user Activated and that delete still closes the account.
• Full doublezero-serviceability suite passes (41 test binaries); Go, Python (97 passed), and TypeScript (116 passed) SDK enum-string tests pass against the updated fixture.