Settings → Activity: an audit log of what happened to accounts

Sign-ins and failed sign-ins, accounts created and sign-ups refused,
password changes, resets and reset links, devices linked and unlinked,
invites made and revoked. Each is kept in `audit_events` with the address
it came from, for `audit_retention_days` (Settings → Security, 90 by
default, 0 keeps them forever), and listed newest first for admins under
Settings → Activity. The retention loop deletes older events.

`audit.record` writes in its own session, so a refusal is kept even when
the request's transaction rolls back. A failure to record is logged and
swallowed, never the reason a sign-in fails. A throttled attempt (429) is
not recorded: a row per refused request would make each request in a
flood cost a database write. Throttle trips stay in the app log.

Also: the storage-limit test puts `storage_quota_gb` back afterwards,
since settings outlive the per-test truncate.

#2939 §5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/public-hosting.md

@@ -4,7 +4,7 @@ Inkwell is built to run on a LAN and works fine there with no ceremony. Exposing
 it changes the threat model: anyone can now reach the login form, and any account is
 one guessed password away from someone's whole note history.
 
-This is what the app does about that on its own, and the four things it cannot do for
+This is what the app does about that on its own, and the three things it cannot do for
 you.
 
 ## Do these five things first
@@ -154,6 +154,24 @@ page shows how much an account uses.
 
 `max_attachment_mb` still caps any single file.
 
+## Activity
+
+**Settings → Activity** lists what has happened to accounts, newest first, with the
+address each came from:
+
+- sign-ins and failed sign-ins;
+- accounts created and sign-ups refused;
+- password changes, resets and reset links;
+- devices linked and unlinked;
+- invites made and revoked.
+
+Events are kept for `audit_retention_days` (Settings → Security, 90 by default; 0
+keeps them forever). Admins only.
+
+A throttled attempt (429) is not listed, so that a flood of them costs no database
+writes. Throttle trips are in the app log, with every event above:
+`docker compose logs app`.
+
 ## What it does not do
 
 Know these before you decide who gets an account.
@@ -165,11 +183,6 @@ Know these before you decide who gets an account.
 - **An admin who forgets their own password**, with email off and no other admin,
   still needs a hand on the database.
 - **No second factor.** A password is the whole of it.
-- **No audit TABLE.** Credential events — sign-ins, failures, throttle trips, new
-  accounts, device tokens issued — are written to the application log and readable
-  with `docker compose logs app`, which is enough to see whether anyone is knocking.
-  They are not queryable, not retained beyond the container's log rotation, and not
-  attributable after the fact.
 
 None of these are hard blockers for an instance whose accounts are you and people you
 know. They are the reason not to hand out open registration to strangers.