feat: add audit, throttle and session foundations

Audit entries written only inside the caller's transaction, database
throttle counters that refuse to run inside a transaction that could roll
back, and a database session store with the user key in its own column,
end_sessions and idle and absolute limits. Ticket 1.3.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt

portal/audit/models.py

@@ -0,0 +1,16 @@
+from django.db import models
+from django.utils import timezone
+
+
+class AuditEntry(models.Model):
+    """Who did what to whom, when and from where. Written only by `audit.services` (AD-4, AD-19)."""
+
+    actor = models.CharField(max_length=256, db_index=True)  # lower-case key
+    action = models.CharField(max_length=128, db_index=True)
+    target = models.CharField(max_length=256, blank=True, default="")
+    ip = models.CharField(max_length=64, blank=True, default="")
+    created_at = models.DateTimeField(default=timezone.now, db_index=True)  # UTC
+    detail = models.JSONField(default=dict, blank=True)
+
+    class Meta:
+        ordering = ["-created_at", "-id"]