feat(db/m7-user-mgmt): migration 0022 + audit helper

Schema for user management U1: display_name on users; user_invites;
registration_settings singleton (default 'invite_only'); audit_log.
Plus the internal/audit package centralizing the action-name
vocabulary and JSON metadata marshaling so handlers don't repeat
boilerplate.

Race-safe first-admin uses a query-shape primitive
(CreateUserFirstAdminRace's WHERE NOT EXISTS subquery) rather than
a schema-level constraint. Concurrent empty-state registrations
both see 'no users yet' and both insert as admin — fine, having
two admins from the start is benign; what matters is at-least-one.
users.username uniqueness arbitrates if the two callers picked the
same username.

CreateUser signature gains display_name (nullable); existing
bootstrap call sites pass nil. The audit package declares the full
U1+U2+U3 action vocabulary upfront so subsequent slices are purely
additive on the caller side.

Tests cover audit Write with + without metadata and that every
declared action constant persists correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/db/migrations/0022_user_management.down.sql

@@ -0,0 +1,9 @@
+-- Reverses migration 0022. Drop tables in reverse dependency order.
+-- This will fail if any rows in audit_log or user_invites reference
+-- users that were deleted with ON DELETE SET NULL semantics; those
+-- references will already be NULL so the drops should succeed cleanly.
+
+DROP TABLE IF EXISTS audit_log;
+DROP TABLE IF EXISTS user_invites;
+DROP TABLE IF EXISTS registration_settings;
+ALTER TABLE users DROP COLUMN IF EXISTS display_name;

internal/db/migrations/0022_user_management.up.sql

@@ -0,0 +1,48 @@
+-- User management foundation (U1 of #376):
+--
+--   - users.display_name: optional human-readable name distinct from username.
+--   - user_invites: admin-generated tokens; user redeems during signup.
+--   - registration_settings (singleton): controls whether registration is
+--     'invite_only' (default after first admin) or 'open' (admin can
+--     re-enable). The handler in U1-T2 also has a special-case for the
+--     "no users yet" state where it ignores invites and lets the first
+--     register as admin.
+--   - audit_log: append-only record of admin-driven user mutations.
+--     No retention policy in v1.
+
+ALTER TABLE users ADD COLUMN IF NOT EXISTS display_name text;
+
+CREATE TABLE user_invites (
+    token         text PRIMARY KEY,
+    invited_by    uuid NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+    note          text,
+    created_at    timestamptz NOT NULL DEFAULT now(),
+    expires_at    timestamptz NOT NULL,
+    redeemed_at   timestamptz,
+    redeemed_by   uuid REFERENCES users(id) ON DELETE SET NULL
+);
+CREATE INDEX user_invites_active_idx
+    ON user_invites (expires_at)
+    WHERE redeemed_at IS NULL;
+
+CREATE TABLE registration_settings (
+    id   boolean PRIMARY KEY DEFAULT true,
+    mode text NOT NULL DEFAULT 'invite_only',
+    CONSTRAINT registration_settings_singleton CHECK (id = true),
+    CONSTRAINT registration_settings_mode_check
+        CHECK (mode IN ('invite_only', 'open'))
+);
+INSERT INTO registration_settings (id) VALUES (true)
+    ON CONFLICT (id) DO NOTHING;
+
+CREATE TABLE audit_log (
+    id          uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+    actor_id    uuid REFERENCES users(id) ON DELETE SET NULL,
+    target_id   uuid REFERENCES users(id) ON DELETE SET NULL,
+    action      text NOT NULL,
+    metadata    jsonb,
+    created_at  timestamptz NOT NULL DEFAULT now()
+);
+CREATE INDEX audit_log_created_at_idx ON audit_log (created_at DESC);
+CREATE INDEX audit_log_actor_id_idx   ON audit_log (actor_id);
+CREATE INDEX audit_log_target_id_idx  ON audit_log (target_id);