feat(db/m7-user-mgmt): migration 0022 + audit helper

Schema for user management U1: display_name on users; user_invites;
registration_settings singleton (default 'invite_only'); audit_log.
Plus the internal/audit package centralizing the action-name
vocabulary and JSON metadata marshaling so handlers don't repeat
boilerplate.

Race-safe first-admin uses a query-shape primitive
(CreateUserFirstAdminRace's WHERE NOT EXISTS subquery) rather than
a schema-level constraint. Concurrent empty-state registrations
both see 'no users yet' and both insert as admin — fine, having
two admins from the start is benign; what matters is at-least-one.
users.username uniqueness arbitrates if the two callers picked the
same username.

CreateUser signature gains display_name (nullable); existing
bootstrap call sites pass nil. The audit package declares the full
U1+U2+U3 action vocabulary upfront so subsequent slices are purely
additive on the caller side.

Tests cover audit Write with + without metadata and that every
declared action constant persists correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/db/dbq/registration_settings.sql.go

@@ -0,0 +1,30 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: registration_settings.sql
+
+package dbq
+
+import (
+	"context"
+)
+
+const getRegistrationMode = `-- name: GetRegistrationMode :one
+SELECT mode FROM registration_settings WHERE id = true
+`
+
+func (q *Queries) GetRegistrationMode(ctx context.Context) (string, error) {
+	row := q.db.QueryRow(ctx, getRegistrationMode)
+	var mode string
+	err := row.Scan(&mode)
+	return mode, err
+}
+
+const setRegistrationMode = `-- name: SetRegistrationMode :exec
+UPDATE registration_settings SET mode = $1 WHERE id = true
+`
+
+func (q *Queries) SetRegistrationMode(ctx context.Context, mode string) error {
+	_, err := q.db.Exec(ctx, setRegistrationMode, mode)
+	return err
+}