Music Assistant enforces an administrator’s decision to disable an account when someone signs in through Home Assistant or opens it from the sidebar. Those routes could previously create a replacement account, issue a token for the disabled one or fail with a database error.
Marcel van der Veldt also makes regular sign-in explain that an account is disabled after the correct password is supplied. Signing out through the HTTP interface closes app connections using that login token, and an unauthenticated sidebar connection receives no events until it authenticates.