fix(auth): record sign-ins when the URL names no congregation

[mindsers]

Description

An instance without congregation subdomains records no sign-in in its audit log.

The login and two-factor routes write user.login, user.login.failed and the failed two-factor challenge only if (urlCongregation), the congregation resolved from the request's host. In single-tenant mode that is always null, so none of those events is ever written, although Settings → Audit log has a filter for sign-ins and for failed attempts. The base domain of a multi-tenant instance has the same gap.

Fix. The event goes to the congregation the URL names, or else to the account's own (resolveLoginAuditCongregationId):

Event	URL names a congregation	URL names none
Sign-in, with or without two-factor	that congregation (unchanged)	the account's congregation
Failed two-factor challenge	that congregation (unchanged)	the account's congregation
Failed attempt, email of an existing account	that congregation (unchanged)	that account's congregation
Failed attempt, email no account uses	that congregation (unchanged)	not recorded

The last cell stays empty on purpose: an audit entry needs a congregation, and that attempt belongs to none.

What changes for an instance

• Single-tenant: sign-ins, failed attempts on existing accounts and failed two-factor challenges start appearing in the audit log. Nothing is backfilled.
• Multi-tenant, on a congregation's subdomain or custom domain: nothing changes.
• Multi-tenant, on the base domain: a sign-in there is now recorded in the account's congregation.

The failed-attempt path does one extra account lookup by email, whether or not the email exists; the audit write itself is not awaited.

Tests. The resolver was written test-first. A new E2E spec signs in, then looks for the entry in the audit log. The sign-in case failed before the fix on a single-tenant server, which is the mode CI runs in; the failed-attempt case was added alongside the fix.

Type de changement

• Bug fix
• Nouvelle fonctionnalité
• Refactoring (pas de changement fonctionnel)
• Documentation
• Autre : ___

Checklist

• J'ai formaté mon code avant de pousser (pnpm build:format)
• J'ai mis à jour la documentation si nécessaire

Issue liée

None.