feat: add audit, throttle and session foundations

Audit entries written only inside the caller's transaction, database
throttle counters that refuse to run inside a transaction that could roll
back, and a database session store with the user key in its own column,
end_sessions and idle and absolute limits. Ticket 1.3.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt

portal/accounts/session_store.py

@@ -0,0 +1,29 @@
+"""Database session store that fills the username and created_at columns."""
+
+from __future__ import annotations
+
+from datetime import UTC, datetime
+
+from django.contrib.sessions.backends.db import SessionStore as DBSessionStore
+from django.utils import timezone
+
+from .models import UserSession
+
+USER_KEY = "session_user_key"
+USER_SAM = "session_user_sam"
+CREATED_AT = "session_created_at"  # epoch seconds, UTC
+
+
+class SessionStore(DBSessionStore):
+    @classmethod
+    def get_model_class(cls):
+        return UserSession
+
+    def create_model_instance(self, data):
+        obj = super().create_model_instance(data)
+        obj.username = str(data.get(USER_KEY, "")).lower()
+        created = data.get(CREATED_AT)
+        obj.created_at = (
+            datetime.fromtimestamp(created, tz=UTC) if created is not None else timezone.now()
+        )
+        return obj