fix(setup): need user write access to re-enable a user from employee status

Setting an employee back to Active re-enabled the linked user with
ignore_permissions, so HR could re-enable a user a System Manager had
disabled. Disabling still runs for anyone; enabling now needs write
access on the user.

(cherry picked from commit d5a6e96c27)

erpnext/setup/doctype/employee/employee.py

@@ -197,11 +197,23 @@ class Employee(NestedSet):
 			return
 
 		user = frappe.get_doc("User", self.user_id)
-		enabled = user.enabled
-		if self.status != "Active" and enabled or self.status == "Active" and enabled == 0:
-			user.enabled = not enabled
-			# Keep linked User status in sync from the Employee lifecycle and record the audit log.
-			user.save(ignore_permissions=True)
+		enable = self.status == "Active"
+		if user.enabled == enable:
+			return
+
+		# Re-enabling restores access, so it needs write access on the User; disabling does not.
+		if enable and not user.has_permission("write"):
+			frappe.msgprint(
+				_("User {0} is disabled. Only a user who can edit Users can enable it.").format(
+					frappe.bold(self.user_id)
+				),
+				alert=True,
+			)
+			return
+
+		user.enabled = enable
+		# Keep linked User status in sync from the Employee lifecycle and record the audit log.
+		user.save(ignore_permissions=True)
 
 	def validate_duplicate_user_id(self):
 		Employee = frappe.qb.DocType("Employee")