feat: add audit, throttle and session foundations

Audit entries written only inside the caller's transaction, database
throttle counters that refuse to run inside a transaction that could roll
back, and a database session store with the user key in its own column,
end_sessions and idle and absolute limits. Ticket 1.3.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt

portal/config/settings.py

@@ -29,6 +29,8 @@ INSTALLED_APPS = [
     "django.contrib.auth",
     "django.contrib.sessions",
     "django.contrib.staticfiles",
+    "portal.audit",
+    "portal.accounts",
 ]
 
 MIDDLEWARE = [
@@ -37,6 +39,7 @@ MIDDLEWARE = [
     "django.middleware.security.SecurityMiddleware",
     "whitenoise.middleware.WhiteNoiseMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",
+    "portal.accounts.middleware.AbsoluteSessionLimitMiddleware",
     "django.middleware.locale.LocaleMiddleware",
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
@@ -91,7 +94,10 @@ STORAGES = {
 }
 
 # Sessions in the database; cookies secure, HttpOnly, SameSite=Lax (AD-6).
-SESSION_ENGINE = "django.contrib.sessions.backends.db"
+SESSION_ENGINE = "portal.accounts.session_store"
+SESSION_COOKIE_AGE = 60 * 60  # idle limit: 1 hour, renewed on every request
+SESSION_SAVE_EVERY_REQUEST = True
+SESSION_ABSOLUTE_SECONDS = 4 * 60 * 60  # absolute limit: 4 hours
 SESSION_COOKIE_SECURE = not DEBUG
 SESSION_COOKIE_HTTPONLY = True
 SESSION_COOKIE_SAMESITE = "Lax"