fix(busylight): Pull-Token deaktivierter Firmen ablehnen

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

backend/app/routers/busylight.py

@@ -110,7 +110,7 @@ async def _company_from_token(
         raise HTTPException(status_code=401, detail="Missing token")
     token_hash = _hash_token(credentials.credentials)
     company = await db.scalar(
-        select(Company).where(Company.busylight_pull_token_hash == token_hash)
+        select(Company).where(Company.busylight_pull_token_hash == token_hash, Company.is_active.is_(True))
     )
     if company is None:
         raise HTTPException(status_code=401, detail="Invalid token")