feat: add audit, throttle and session foundations

Audit entries written only inside the caller's transaction, database
throttle counters that refuse to run inside a transaction that could roll
back, and a database session store with the user key in its own column,
end_sessions and idle and absolute limits. Ticket 1.3.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt

pyproject.toml

@@ -34,7 +34,7 @@ env = [
 [tool.ruff]
 line-length = 100
 target-version = "py313"
-extend-exclude = ["_bmad", "_bmad-output", ".agents", "context-resources"]
+extend-exclude = ["**/migrations", "_bmad", "_bmad-output", ".agents", "context-resources"]
 
 [tool.ruff.lint]
 select = ["E", "F", "I", "B", "UP", "S"]