feat(db/m7-user-mgmt): migration 0022 + audit helper

Schema for user management U1: display_name on users; user_invites;
registration_settings singleton (default 'invite_only'); audit_log.
Plus the internal/audit package centralizing the action-name
vocabulary and JSON metadata marshaling so handlers don't repeat
boilerplate.

Race-safe first-admin uses a query-shape primitive
(CreateUserFirstAdminRace's WHERE NOT EXISTS subquery) rather than
a schema-level constraint. Concurrent empty-state registrations
both see 'no users yet' and both insert as admin — fine, having
two admins from the start is benign; what matters is at-least-one.
users.username uniqueness arbitrates if the two callers picked the
same username.

CreateUser signature gains display_name (nullable); existing
bootstrap call sites pass nil. The audit package declares the full
U1+U2+U3 action vocabulary upfront so subsequent slices are purely
additive on the caller side.

Tests cover audit Write with + without metadata and that every
declared action constant persists correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/db/dbq/models.go

@@ -231,6 +231,15 @@ type ArtistSimilarityUnmatched struct {
 	FetchedAt     pgtype.Timestamptz
 }
 
+type AuditLog struct {
+	ID        pgtype.UUID
+	ActorID   pgtype.UUID
+	TargetID  pgtype.UUID
+	Action    string
+	Metadata  []byte
+	CreatedAt pgtype.Timestamptz
+}
+
 type ContextualLike struct {
 	ID            pgtype.UUID
 	UserID        pgtype.UUID
@@ -383,6 +392,11 @@ type PlaylistTrack struct {
 	AddedAt     pgtype.Timestamptz
 }
 
+type RegistrationSetting struct {
+	ID   bool
+	Mode string
+}
+
 type ScanRun struct {
 	ID              pgtype.UUID
 	StartedAt       pgtype.Timestamptz
@@ -476,4 +490,15 @@ type User struct {
 	SubsonicPassword    *string
 	ListenbrainzToken   *string
 	ListenbrainzEnabled bool
+	DisplayName         *string
+}
+
+type UserInvite struct {
+	Token      string
+	InvitedBy  pgtype.UUID
+	Note       *string
+	CreatedAt  pgtype.Timestamptz
+	ExpiresAt  pgtype.Timestamptz
+	RedeemedAt pgtype.Timestamptz
+	RedeemedBy pgtype.UUID
 }