feat(db/m7-user-mgmt): migration 0022 + audit helper

Schema for user management U1: display_name on users; user_invites;
registration_settings singleton (default 'invite_only'); audit_log.
Plus the internal/audit package centralizing the action-name
vocabulary and JSON metadata marshaling so handlers don't repeat
boilerplate.

Race-safe first-admin uses a query-shape primitive
(CreateUserFirstAdminRace's WHERE NOT EXISTS subquery) rather than
a schema-level constraint. Concurrent empty-state registrations
both see 'no users yet' and both insert as admin — fine, having
two admins from the start is benign; what matters is at-least-one.
users.username uniqueness arbitrates if the two callers picked the
same username.

CreateUser signature gains display_name (nullable); existing
bootstrap call sites pass nil. The audit package declares the full
U1+U2+U3 action vocabulary upfront so subsequent slices are purely
additive on the caller side.

Tests cover audit Write with + without metadata and that every
declared action constant persists correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/db/dbq/audit_log.sql.go

@@ -0,0 +1,72 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: audit_log.sql
+
+package dbq
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5/pgtype"
+)
+
+const listAuditLog = `-- name: ListAuditLog :many
+SELECT id, actor_id, target_id, action, metadata, created_at FROM audit_log
+ ORDER BY created_at DESC
+ LIMIT $1 OFFSET $2
+`
+
+type ListAuditLogParams struct {
+	Limit  int32
+	Offset int32
+}
+
+func (q *Queries) ListAuditLog(ctx context.Context, arg ListAuditLogParams) ([]AuditLog, error) {
+	rows, err := q.db.Query(ctx, listAuditLog, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []AuditLog
+	for rows.Next() {
+		var i AuditLog
+		if err := rows.Scan(
+			&i.ID,
+			&i.ActorID,
+			&i.TargetID,
+			&i.Action,
+			&i.Metadata,
+			&i.CreatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const writeAuditLog = `-- name: WriteAuditLog :exec
+INSERT INTO audit_log (actor_id, target_id, action, metadata)
+VALUES ($1, $2, $3, $4)
+`
+
+type WriteAuditLogParams struct {
+	ActorID  pgtype.UUID
+	TargetID pgtype.UUID
+	Action   string
+	Metadata []byte
+}
+
+func (q *Queries) WriteAuditLog(ctx context.Context, arg WriteAuditLogParams) error {
+	_, err := q.db.Exec(ctx, writeAuditLog,
+		arg.ActorID,
+		arg.TargetID,
+		arg.Action,
+		arg.Metadata,
+	)
+	return err
+}