feat: add audit, throttle and session foundations

Audit entries written only inside the caller's transaction, database
throttle counters that refuse to run inside a transaction that could roll
back, and a database session store with the user key in its own column,
end_sessions and idle and absolute limits. Ticket 1.3.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt

portal/accounts/middleware.py

@@ -0,0 +1,20 @@
+"""Absolute session limit; the idle limit is SESSION_COOKIE_AGE with save-every-request."""
+
+import time
+
+from django.conf import settings
+
+from .session_store import CREATED_AT
+
+
+class AbsoluteSessionLimitMiddleware:
+    def __init__(self, get_response):
+        self.get_response = get_response
+
+    def __call__(self, request):
+        session = request.session
+        created = session.get(CREATED_AT)
+        if created is not None and time.time() - created > settings.SESSION_ABSOLUTE_SECONDS:
+            # flush() deletes the row; the empty session makes SessionMiddleware clear the cookie.
+            session.flush()
+        return self.get_response(request)