Only successful logins wrote an audit row. Every unsuccessful attempt now
writes `login_failed` with reason bad_credentials, unknown_user,
inactive, or throttled, plus the client IP. The attempted username is
recorded only when it matches a real account (as the actor); unknown-user
attempts store no username, since people sometimes type a password into
that field.
Found while preparing Phase 0 control evidence (milestone 0.9).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
