feat(audit): split actor from subject on auth events

auth_events.user_id was overloaded and meant something different per call
site: admin mutations filed the row under the target user and hid the acting
admin in metadata->>'by', team events filed it under the actor, and quota
events switched between the two depending on scope. The practical consequence
was that "show me everything admin X did" had no answer.

Adds actor_id (never NULL) and target_id (NULL when the event is not about a
user) alongside the existing column, which keeps its meaning as the per-user
feed key so nothing historical is rewritten. The backfill recovers the actor
from metadata for rows that predate the columns.

Also adds the indexes the cross-user admin feed needs. The only index was
(user_id, created_at DESC), so the global feed -- which orders by created_at
with no user predicate -- fell back to a sequential scan plus a sort on every
page.

The feed gains actor, multi-event, until and free-text search filters, plus a
distinct-event catalogue so the UI can offer what the instance recorded
instead of asking operators to type a name from memory.

docsgpt/api/oidc/routes.py

@@ -26,7 +26,10 @@ from docsgpt.api.oidc import denylist, provider
 from docsgpt.auth import handle_auth
 from docsgpt.cache import get_redis_instance
 from docsgpt.core.settings import settings
-from docsgpt.storage.db.repositories.auth_events import AuthEventsRepository
+from docsgpt.storage.db.repositories.auth_events import (
+    SYSTEM_ACTOR_OIDC,
+    AuthEventsRepository,
+)
 from docsgpt.storage.db.repositories.user_roles import UserRolesRepository
 from docsgpt.storage.db.repositories.users import UsersRepository
 from docsgpt.storage.db.session import db_readonly, db_session
@@ -129,6 +132,9 @@ def _reconcile_oidc_admin(user_id: str, groups: list[str] | None) -> None:
                     ip=request.remote_addr,
                     user_agent=request.headers.get("User-Agent"),
                     metadata={"role": "admin", "source": "oidc_group"},
+                    # The provider's group membership drove this, not the user.
+                    actor_id=SYSTEM_ACTOR_OIDC,
+                    target_id=user_id,
                 )
     except Exception:
         logger.error("OIDC admin reconcile failed for %s", user_id, exc_info=True)