fix(traffic): re-enable quota-disabled clients on inbound and reset-all resets (#6833)

Running out of quota switches a client off in client_traffics, in its client
record and in the inbound settings JSON. The inbound's periodic reset and the
Reset All Client Traffic button only set client_traffics.enable back, so the
client showed zero usage but stayed out of the running core every period.

Both paths now read the disabled, depleted emails inside the transaction that
zeroes the counters, on the traffic writer, and re-enable them through
BulkSetEnable after the commit, like every other reset path. Reading them inside
that transaction keeps a traffic tick from disabling a client between the read
and the reset.

internal/web/service/client_bulk_reset_reenable_test.go

@@ -27,3 +27,24 @@ func TestBulkResetTraffic_ReenablesDisabledClient(t *testing.T) {
 		t.Fatalf("%s: traffic after reset up=%d down=%d, want 0/0", email, tr.Up, tr.Down)
 	}
 }
+
+func TestResetAllTraffics_ReenablesDepletedClientEverywhere(t *testing.T) {
+	setupBulkDB(t)
+	svc := &ClientService{}
+	inboundSvc := &InboundService{}
+
+	depleted := seedLocalDisabledClient(t, svc, 52011, "", "spent-all@x", 1000, 0, 600, 500)
+	banned := seedLocalDisabledClient(t, svc, 52012, "", "banned-all@x", 100000, 0, 600, 500)
+
+	if _, err := svc.ResetAllTraffics(); err != nil {
+		t.Fatalf("ResetAllTraffics: %v", err)
+	}
+
+	assertEnableEverywhere(t, svc, inboundSvc, depleted.Id, "spent-all@x", true)
+	if recordEnableOf(t, svc, "banned-all@x") {
+		t.Fatal("banned-all@x: an operator-disabled client was switched back on by Reset All Client Traffic")
+	}
+	if jsonClientEnable(t, inboundSvc, banned.Id, "banned-all@x") {
+		t.Fatal("banned-all@x: an operator-disabled client was enabled in the inbound JSON")
+	}
+}