fix(iter-v2): T01 QA fixes - race condition, hook regex, deleted user check

- BUG-1: Pre-commit hook allows .env.example (grep -v filter)
- BUG-2: /auth/refresh uses transaction + FOR UPDATE to prevent race condition
- WARN-1: Auth middleware checks deleted_at with 5-min TTL cache
- WARN-2: PUT /admin/users/:id/status filters deleted_at IS NULL
- WARN-3: Install node-cron@^3.0.3

.githooks/pre-commit

@@ -1,7 +1,10 @@
 #!/bin/sh
-# Prevent .env files from being committed
-if git diff --cached --name-only | grep -E '\.env$|\.env\.'; then
+# Prevent .env files (except .env.example) from being committed
+STAGED_ENV=$(git diff --cached --name-only | grep -E '\.env$|\.env\.' | grep -v '\.env\.example$')
+if [ -n "$STAGED_ENV" ]; then
   echo "❌ ERROR: Attempting to commit .env file(s). This is blocked for security."
+  echo "   Blocked files:"
+  echo "$STAGED_ENV"
   echo "   If you need to update .env.example, that's allowed."
   exit 1
 fi