feat: add audit, throttle and session foundations

Audit entries written only inside the caller's transaction, database
throttle counters that refuse to run inside a transaction that could roll
back, and a database session store with the user key in its own column,
end_sessions and idle and absolute limits. Ticket 1.3.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt

portal/audit/migrations/0001_initial.py

@@ -0,0 +1,30 @@
+# Generated by Django 5.2.18 on 2026-10-15 13:40
+
+import django.utils.timezone
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='AuditEntry',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('actor', models.CharField(db_index=True, max_length=256)),
+                ('action', models.CharField(db_index=True, max_length=128)),
+                ('target', models.CharField(blank=True, default='', max_length=256)),
+                ('ip', models.CharField(blank=True, default='', max_length=64)),
+                ('created_at', models.DateTimeField(db_index=True, default=django.utils.timezone.now)),
+                ('detail', models.JSONField(blank=True, default=dict)),
+            ],
+            options={
+                'ordering': ['-created_at', '-id'],
+            },
+        ),
+    ]