Settings → Activity: an audit log of what happened to accounts

Sign-ins and failed sign-ins, accounts created and sign-ups refused,
password changes, resets and reset links, devices linked and unlinked,
invites made and revoked. Each is kept in `audit_events` with the address
it came from, for `audit_retention_days` (Settings → Security, 90 by
default, 0 keeps them forever), and listed newest first for admins under
Settings → Activity. The retention loop deletes older events.

`audit.record` writes in its own session, so a refusal is kept even when
the request's transaction rolls back. A failure to record is logged and
swallowed, never the reason a sign-in fails. A throttled attempt (429) is
not recorded: a row per refused request would make each request in a
flood cost a database write. Throttle trips stay in the app log.

Also: the storage-limit test puts `storage_quota_gb` back afterwards,
since settings outlive the per-test truncate.

#2939 §5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/views/SettingsView.vue

@@ -8,6 +8,7 @@ import BaseButton from "../components/BaseButton.vue";
 import PageHeader from "../components/PageHeader.vue";
 import InviteList from "../components/InviteList.vue";
 import AccountList from "../components/AccountList.vue";
+import ActivityList from "../components/ActivityList.vue";
 import GroupList from "../components/GroupList.vue";
 import { errorMessage } from "../api/errors";
 import { useUiStore } from "../stores/ui";
@@ -187,5 +188,6 @@ onMounted(load);
     <InviteList v-if="items.length" class="mt-10" />
     <AccountList v-if="items.length" class="mt-10" />
     <GroupList v-if="items.length" class="mt-10" />
+    <ActivityList v-if="items.length" class="mt-10" />
   </div>
 </template>