post:
  operationId: updateStaffStatus
  summary: Activate or deactivate a staff user
  description: |
    Permission: **staff:toggle_status**

    Updates a staff account status. Request status values are lowercase:
    `active` or `deactivated`. The service persists them as `ACTIVE` or
    `DEACTIVATED`.
  tags: [staffManagement]
  security:
    - bearerAuth: []
  requestBody:
    required: true
    content:
      application/json:
        schema:
          $ref: "../../components.yaml#/components/schemas/UpdateStaffStatusRequest"
        example:
          staff_id: "6643f1a2b4c5d60012e34abc"
          status: "deactivated"
  responses:
    "200":
      description: Staff status updated — DTO returned directly
      content:
        application/json:
          schema:
            $ref: "../../components.yaml#/components/schemas/UpdateStaffStatusResponse"
          example:
            code: 0
            message: "success"
            staff_id: "6643f1a2b4c5d60012e34abc"
            status: "deactivated"
    "400":
      $ref: "../../components.yaml#/components/responses/Failure"