Is there any way to restrict the movement of cards from resolved to active Azure DevOps?
Microsoft added this feature recently (in Sprint 177 update):
You need of course to use an Inherited Process.
See the docs here.