Show user sign-in history and outcomes

Record successful and failed password sign-in outcomes for known accounts with bounded, non-secret reason codes, then show them on the user detail page. Extend the existing append-only authentication security-event stream rather than business revision history. Unknown-account attempts must remain unlinked, and no submitted email, password, session token, CSRF secret, credential hash, peer address, or rate-limit key may enter history.\n\nAcceptance criteria:\n- Successful known-account sign-ins record the account, timestamp, request ID, and a success reason code.\n- Failed known-account password attempts record the account and a precise safe reason such as invalid password, disabled account, changed credential, or replaced login step.\n- Unknown-account attempts remain unassociated with a user and are not displayed on user details.\n- User details show a localized sign-in history separate from audited account/access changes.\n- Existing rate limits, generic browser errors, session rotation, credential rechecks, and secret-exclusion guarantees remain intact.\n- Database, service, browser, documentation, and migration tests pass.