feat(db/m7-user-mgmt): migration 0022 + audit helper

Schema for user management U1: display_name on users; user_invites;
registration_settings singleton (default 'invite_only'); audit_log.
Plus the internal/audit package centralizing the action-name
vocabulary and JSON metadata marshaling so handlers don't repeat
boilerplate.

Race-safe first-admin uses a query-shape primitive
(CreateUserFirstAdminRace's WHERE NOT EXISTS subquery) rather than
a schema-level constraint. Concurrent empty-state registrations
both see 'no users yet' and both insert as admin — fine, having
two admins from the start is benign; what matters is at-least-one.
users.username uniqueness arbitrates if the two callers picked the
same username.

CreateUser signature gains display_name (nullable); existing
bootstrap call sites pass nil. The audit package declares the full
U1+U2+U3 action vocabulary upfront so subsequent slices are purely
additive on the caller side.

Tests cover audit Write with + without metadata and that every
declared action constant persists correctly.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/db/queries/audit_log.sql

@@ -0,0 +1,8 @@
+-- name: WriteAuditLog :exec
+INSERT INTO audit_log (actor_id, target_id, action, metadata)
+VALUES ($1, $2, $3, $4);
+
+-- name: ListAuditLog :many
+SELECT * FROM audit_log
+ ORDER BY created_at DESC
+ LIMIT $1 OFFSET $2;

internal/db/queries/invites.sql

@@ -0,0 +1,35 @@
+-- name: CreateInvite :one
+INSERT INTO user_invites (token, invited_by, note, expires_at)
+VALUES ($1, $2, $3, $4)
+RETURNING *;
+
+-- name: GetInviteByToken :one
+SELECT * FROM user_invites WHERE token = $1;
+
+-- name: ListInvitesActive :many
+-- Active = not redeemed and not expired. Used by the admin invites
+-- panel as the primary list.
+SELECT * FROM user_invites
+ WHERE redeemed_at IS NULL AND expires_at > now()
+ ORDER BY created_at DESC;
+
+-- name: ListInvitesAll :many
+-- Includes redeemed + expired for full audit visibility. Caller
+-- supplies a LIMIT to bound the response.
+SELECT * FROM user_invites
+ ORDER BY created_at DESC
+ LIMIT $1;
+
+-- name: RedeemInvite :execrows
+-- Atomic claim: returns rows-affected so the caller can detect
+-- already-redeemed / expired tokens (rows=0) versus successful claim
+-- (rows=1). Use this from the registration handler.
+UPDATE user_invites
+   SET redeemed_at = now(), redeemed_by = $2
+ WHERE token = $1
+   AND redeemed_at IS NULL
+   AND expires_at > now();
+
+-- name: DeleteInvite :exec
+-- Admin-revoke. Only deletes unredeemed invites.
+DELETE FROM user_invites WHERE token = $1 AND redeemed_at IS NULL;

internal/db/queries/registration_settings.sql

@@ -0,0 +1,5 @@
+-- name: GetRegistrationMode :one
+SELECT mode FROM registration_settings WHERE id = true;
+
+-- name: SetRegistrationMode :exec
+UPDATE registration_settings SET mode = $1 WHERE id = true;

internal/db/queries/users.sql

@@ -1,6 +1,28 @@
 -- name: CreateUser :one
-INSERT INTO users (username, password_hash, api_token, is_admin)
-VALUES ($1, $2, $3, $4)
+INSERT INTO users (username, password_hash, api_token, is_admin, display_name)
+VALUES ($1, $2, $3, $4, $5)
+RETURNING *;
+
+-- name: CreateUserFirstAdminRace :one
+-- Inserts a new user; sets is_admin=true ONLY when no users currently
+-- exist. The (SELECT NOT EXISTS ...) subquery is evaluated at INSERT
+-- time within the same statement, so the result reflects committed
+-- state at that moment.
+--
+-- Race semantics: two concurrent calls in an empty-users state may
+-- both observe "no users" and both insert with is_admin=true. That's
+-- benign — having two admins from the gate is fine; what matters is
+-- that there's AT LEAST one. If the two calls happened to share the
+-- same username, the unique constraint on users.username arbitrates
+-- and the second caller's INSERT fails with a unique violation. The
+-- caller (registration handler) can retry as a regular non-admin in
+-- that case (or surface a "username taken" error to the user).
+INSERT INTO users (username, password_hash, api_token, is_admin, display_name)
+VALUES (
+    $1, $2, $3,
+    (SELECT NOT EXISTS (SELECT 1 FROM users)),
+    $4
+)
 RETURNING *;
 
 -- name: GetUserByUsername :one