Settings → Activity: an audit log of what happened to accounts

Sign-ins and failed sign-ins, accounts created and sign-ups refused,
password changes, resets and reset links, devices linked and unlinked,
invites made and revoked. Each is kept in `audit_events` with the address
it came from, for `audit_retention_days` (Settings → Security, 90 by
default, 0 keeps them forever), and listed newest first for admins under
Settings → Activity. The retention loop deletes older events.

`audit.record` writes in its own session, so a refusal is kept even when
the request's transaction rolls back. A failure to record is logged and
swallowed, never the reason a sign-in fails. A throttled attempt (429) is
not recorded: a row per refused request would make each request in a
flood cost a database write. Throttle trips stay in the app log.

Also: the storage-limit test puts `storage_quota_gb` back afterwards,
since settings outlive the per-test truncate.

#2939 §5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

alembic/versions/0039_audit_events.py

@@ -0,0 +1,41 @@
+"""audit_events: the audit log
+
+Revision ID: 0039
+Revises: 0038
+Create Date: 2026-10-08
+
+Credential events were only written to the app log, which is not queryable and is
+gone at the container's log rotation (#2939 §5). This keeps them in the database for
+`audit_retention_days`, for admins to read in Settings → Activity.
+
+## Downgrade
+
+Drops the table and every event in it.
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0039"
+down_revision = "0038"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "audit_events",
+        sa.Column("id", UUID(as_uuid=True), primary_key=True),
+        sa.Column("at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.Column("event", sa.Text(), nullable=False),
+        sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="SET NULL"), nullable=True),
+        sa.Column("email", sa.Text(), nullable=True),
+        sa.Column("address", sa.Text(), nullable=True),
+        sa.Column("detail", sa.Text(), nullable=True),
+    )
+    op.create_index("ix_audit_events_at", "audit_events", ["at"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_audit_events_at", table_name="audit_events")
+    op.drop_table("audit_events")