Suspending a person says their keys are refused, which they are

The message said their API keys still worked and should be revoked; the
store has refused a key whose owner is not active for a while. Tried on
the test cluster: refused 26 s after the suspend (auth.cache_ttl, 30 s),
answered again 6 s after reinstating.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/cli/users.go

@@ -171,7 +171,10 @@ func newUserStateCmd(open userOpener, verb string, state store.UserState, short
 				if err := s.DeleteUserSessions(cmd.Context(), u.ID); err != nil {
 					return err
 				}
-				cmd.PrintErrln("Their sessions were closed. Their API keys still work — revoke those separately.")
+				// The keys are refused by their owner's state, which every
+				// router reads again within auth.cache_ttl.
+				cmd.PrintErrln("Their sessions were closed. Their API keys are refused within auth.cache_ttl " +
+					"(30 s by default), and work again if they are reinstated.")
 			}
 			fmt.Fprintf(cmd.OutOrStdout(), "%s is now %s\n", u.Email, state)
 			return nil