Replace raw email in auth.login_failed metadata_ with a 16-char SHA-256 prefix (attempted_email_hash). Update AuditLogTab.vue to display the hash field instead. This removes plaintext email PII from the unencrypted audit_logs JSONB column as required by CLAUDE.md. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>