feat(account): Steam ID and blocked state from Auth (V25)

A blocked user gets no sync and leaves the landing stats. A new or removed Steam ID stops the nightly sync of the old one. No token check in Core: the token lives until it expires.

src/test/resources/contract/auth-core-contract.json

@@ -55,6 +55,16 @@
       "path": "/internal/accounts/deleted",
       "request": {"userIds": []}
     },
+    "applyStates": {
+      "method": "POST",
+      "path": "/internal/accounts/states",
+      "request": {"accounts": [{"userId": 42, "steamId": 76561198000000001, "blocked": true}]}
+    },
+    "replaceStates": {
+      "method": "PUT",
+      "path": "/internal/accounts/states",
+      "request": {"accounts": [{"userId": 42, "steamId": null, "blocked": false}]}
+    },
     "purge": {
       "method": "POST",
       "path": "/internal/accounts/purge",