fix: rebuild Deny policy on account restore

Deny policy (AirGate_Deny_{username}) was removed during disable
but not recreated on restore. Now _update_deny_policy is called
during restore to rebuild project isolation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/apps/monitor/views.py

@@ -645,6 +645,9 @@ def iam_user_enable_view(request, pk):
             except VolcengineAPIError as restore_err:
                 restore_errors.append(f"{p['name']}: {restore_err}")
 
+        # 3. 重建 Deny 策略（项目隔离）
+        _update_deny_policy(user)
+
         user.status = IAMUser.Status.ACTIVE
         user.saved_policies_on_disable = []
         user.volc_login_allowed = restore_login