fix(06): CR-05 hash attempted email in audit log to avoid PII storage

Replace raw email in auth.login_failed metadata_ with a 16-char
SHA-256 prefix (attempted_email_hash). Update AuditLogTab.vue to
display the hash field instead. This removes plaintext email PII from
the unencrypted audit_logs JSONB column as required by CLAUDE.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/auth.py

@@ -19,6 +19,7 @@ Security invariants:
 """
 from __future__ import annotations
 
+import hashlib
 import uuid
 from typing import Literal, Optional
 
@@ -213,7 +214,7 @@ async def login(
             actor_id=user.id if user else None,
             resource_id=None,
             ip_address=_ip,
-            metadata_={"attempted_email": str(body.email)},
+            metadata_={"attempted_email_hash": hashlib.sha256(str(body.email).encode()).hexdigest()[:16]},
         )
         await session.commit()
         raise HTTPException(