fix(06): CR-05 hash attempted email in audit log to avoid PII storage

Replace raw email in auth.login_failed metadata_ with a 16-char
SHA-256 prefix (attempted_email_hash). Update AuditLogTab.vue to
display the hash field instead. This removes plaintext email PII from
the unencrypted audit_logs JSONB column as required by CLAUDE.md.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/api/auth.py

@@ -19,6 +19,7 @@ Security invariants:
 """
 from __future__ import annotations
 
+import hashlib
 import uuid
 from typing import Literal, Optional
 
@@ -213,7 +214,7 @@ async def login(
             actor_id=user.id if user else None,
             resource_id=None,
             ip_address=_ip,
-            metadata_={"attempted_email": str(body.email)},
+            metadata_={"attempted_email_hash": hashlib.sha256(str(body.email).encode()).hexdigest()[:16]},
         )
         await session.commit()
         raise HTTPException(

frontend/src/components/admin/AuditLogTab.vue

@@ -111,7 +111,7 @@
             <td class="px-4 py-3 text-sm text-gray-700">{{ entry.user_handle || entry.user_id || '—' }}</td>
             <td class="px-4 py-3 text-sm text-gray-500">
               <span v-if="entry.user_email">{{ entry.user_email }}</span>
-              <span v-else-if="entry.metadata_?.attempted_email" class="text-amber-600">{{ entry.metadata_.attempted_email }} <span class="text-xs">(attempted)</span></span>
+              <span v-else-if="entry.metadata_?.attempted_email_hash" class="text-amber-600 font-mono text-xs">hash:{{ entry.metadata_.attempted_email_hash }} <span class="text-xs not-italic">(attempted)</span></span>
               <span v-else>—</span>
             </td>
             <td class="px-4 py-3">