Implement billing status notification and enhance user management integration

- Added `NotifyBillingStatusChangedAsync` method to `IRealtimeNotifier` for notifying clients about changes in billing status.
- Updated `BillingConfigResumer` to call the new notification method after modifying billing configurations, ensuring users receive real-time updates.
- Enhanced `ListUsersQueryHandler` to include a `BillingPendingReview` property in `UserSummaryDto`, indicating if a user has a pending payment request awaiting confirmation.
- Refactored various command handlers to utilize `AdvisoryLock` for managing concurrent requests, preventing race conditions in billing operations.
- Updated tests to cover new notification behaviors and ensure proper functionality in billing status management.

backend/tests/PnvPanel.Application.Tests/Telegram/GetLoginRequestStatusQueryHandlerTests.cs

@@ -150,4 +150,74 @@ public class GetLoginRequestStatusQueryHandlerTests
         Assert.False(result.IsSuccess);
         Assert.Equal(AuthErrors.Unauthorized, result.Error);
     }
+
+    [Fact]
+    public async Task Handle_WhenApprovedAndUserBlocked_ReturnsUserBlockedWithoutIssuingTokens()
+    {
+        using var dbContext = InMemoryDbContextFactory.Create();
+        var userId = Guid.NewGuid();
+        var request = TelegramLoginRequest.Create(TimeSpan.FromMinutes(5), null);
+        request.Approve(userId);
+        dbContext.TelegramLoginRequests.Add(request);
+        await dbContext.SaveChangesAsync(CancellationToken.None);
+
+        var profile = new CurrentUserProfile(
+            userId,
+            "alice",
+            Guid.NewGuid(),
+            "user",
+            true,
+            true,
+            3,
+            RoleQuota.Unlimited,
+            "sub-token",
+            false,
+            null,
+            false
+        );
+        _identityService.GetProfileAsync(userId, Arg.Any<CancellationToken>()).Returns(profile);
+
+        var handler = CreateHandler(dbContext);
+
+        var result = await handler.Handle(
+            new TelegramNs.GetLoginRequestStatusQuery(request.Id),
+            CancellationToken.None
+        );
+
+        Assert.False(result.IsSuccess);
+        Assert.Equal(AuthErrors.UserBlocked, result.Error);
+        // Уже потреблён предыдущим прогоном лока — токены выпустить не успели, но повторно claim'ить нельзя.
+        Assert.Equal(TelegramLoginStatus.Consumed, request.Status);
+        await _refreshTokenService
+            .DidNotReceive()
+            .IssueAsync(Arg.Any<Guid>(), Arg.Any<CancellationToken>());
+    }
+
+    [Fact]
+    public async Task Handle_WhenAlreadyConsumedByAnotherPoll_ReturnsConsumedWithoutTokens()
+    {
+        // Второй поллер той же вкладки после того, как первый уже забрал вход (Consume()) —
+        // короткий путь ДО AdvisoryLock (status != Approved), токены повторно не выпускаются.
+        using var dbContext = InMemoryDbContextFactory.Create();
+        var userId = Guid.NewGuid();
+        var request = TelegramLoginRequest.Create(TimeSpan.FromMinutes(5), null);
+        request.Approve(userId);
+        request.Consume();
+        dbContext.TelegramLoginRequests.Add(request);
+        await dbContext.SaveChangesAsync(CancellationToken.None);
+
+        var handler = CreateHandler(dbContext);
+
+        var result = await handler.Handle(
+            new TelegramNs.GetLoginRequestStatusQuery(request.Id),
+            CancellationToken.None
+        );
+
+        Assert.True(result.IsSuccess);
+        Assert.Equal(TelegramLoginStatus.Consumed, result.Value.Status);
+        Assert.Null(result.Value.Auth);
+        await _refreshTokenService
+            .DidNotReceive()
+            .IssueAsync(Arg.Any<Guid>(), Arg.Any<CancellationToken>());
+    }
 }