invalidate authentication for locked accounts

src/class/Security.ts

@@ -40,6 +40,7 @@ export default class Security {
       const res: any = jwt.verify(bearer, this.keys.key, { issuer: 'Library of Code sp-us | CSD' });
       const account = await this.client.db.Account.findOne({ _id: res.id });
       if (!account) return null;
+      if (account.locked) return null;
       if (account.revokedBearers?.includes(bearer)) return null;
       return account;
     } catch {