Inactive authenticated users are now redirected to /auth/reactivate/ before the GET login view honors a ?next= URL. Previously, the GET path redirected authenticated users directly to the requested destination without checking is_active, which could trap an inactive user in a redirect loop between /auth/login/ and a protected view.

The POST login path already applied the is_active guard correctly; this change ports the same check to the GET redirect branch and adds a regression test that confirms the loop no longer occurs when an inactive user arrives with a next parameter.