feat: Move user-import, token, and event cleanup to housekeeping

[hellopablo]

Summary

• Cherry-pick of feat: Move user-import, token, and event cleanup to housekeeping #544 onto feature/pre-new-admin.
• Nails\Auth\Housekeeping\UserImports keeps the three-step import cleaner (release stale claims, reap drafts, rotate finished jobs) with item-level audit logs and dry-run. auth:user:import:process is untouched.
• Nails\Auth\Housekeeping\AccessTokens deletes expired API access tokens (@daily). Logs id, user_id, expires — not the token secret.
• Nails\Auth\Housekeeping\TwoFactorTokens deletes expired legacy 2FA rows from user_auth_two_factor_token (*/15 * * * *). Logs id, user_id, expires — not token / salt.
• Nails\Auth\Housekeeping\UserEvents deletes user_event rows older than AUTH_USER_EVENT_RETENTION_DAYS. Unset or 0 disables deletion (no module default). Runs @daily.
• Access tokens, legacy 2FA tokens, and user events had no scheduled cleaner before.
• Removes auth:user:import:clean (cron task and console command). Run on demand with housekeeping:run --routine=….
• Requires nails/module-housekeeping: dev-feature/pre-new-admin.

Test plan

• composer analyse / composer test
• nails housekeeping:list shows UserImports, AccessTokens, TwoFactorTokens, UserEvents
• Dry-run UserImports: RELEASE / DELETE lines, no writes
• Dry-run the new reapers; confirm token secrets are not logged
• With no AUTH_USER_EVENT_RETENTION_DAYS, UserEvents logs DISABLED and processes 0
• nails auth:user:import:clean is gone

Made with Cursor