#4217 Reads other than findById still treat a lapsed temporary ban as active until the operative next signs in

From swamp-club#4194, which makes findById, findByUsername and findBannedIds honour banExpires. These reads still filter on the banned flag alone: username search, email and username lookups and listAdminUsers in better-auth-operative-queries.ts, resolveUsername in oauth-queries.ts (used by routes/api/auth/resolve-user.ts and the admin proxy), member reads in better-auth-collective-queries.ts, the aggregation in mongo-extension-repository.ts, and bannedUsernames in lib/app/repos.ts. After a temporary ban lapses, the operative's key works but they stay hidden on these surfaces until their next browser sign-in. Expected: these reads apply the same not-actively-banned rule.