Add account security audit, OAuth activity, and admin analytics

[tiankaima]

Summary

• expand account, OAuth, admin, homework, and collaborative-content audit coverage with bounded retention and privacy-safe projections
• add user-facing security activity, authorized-app usage, private calendar credential rotation, and admin audit/analytics views
• harden recent-session checks, RLS/runtime grants, audit queue idempotency, account deletion, and OAuth consent/revocation paths
• align Admin desktop/mobile data views, including centered suspension state cells and accessible audit semantics
• expose private calendar feed URLs only when an OAuth token also grants workspace.calendar-feed:read; unscoped OAuth and session responses receive null fields without reading or minting a token
• aggregate scoped calendar-feed access in OAuth grant usage analytics
• invalidate incompatible catalog detail caches across the strict response-schema deployment

Local verification

• Chromium E2E: 427 passed, 1 environment-dependent test skipped
• Admin Chromium suite: 61/61 passed
• Admin mobile overflow + serious/critical a11y checks: 6/6 passed
• REST contract suite on a fresh database: 333/333 passed
• Vitest integration suite: 260 passed, 54 skipped by configured environment
• Unit suite: 2283/2283 passed
• production build, Wrangler types, Biome, Svelte check (0 errors), three TypeScript configs, OpenAPI generation, and production dependency audit passed
• production-like upgrade test from origin/main passed, including historical audit migration, indexes, RLS, runtime grants, and guarded account deletion

Downstream coordination

• CLI: Adopt scoped calendar feed OAuth access cli#40
• Bot: Life-USTC/bot#74

Both consumers pin this PR final contract revision and pass race-enabled test suites.

Rolling release

The user approved an uninterrupted rolling release without a maintenance page. The schema and Worker are intentionally not backward compatible, so database migration and Cloudflare Git deployment must be watched together; a short partial-error window can occur for the affected account/audit features, but whole-site downtime is not expected. Production queue and DLQ resources exist. After merge, monitor the automatic database migration and Cloudflare deployment, then run SQL verification and application/OAuth smoke tests before merging downstream consumers.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	life-ustc	dabcb0a	Aug 16 2026, 10:48 AM

[github-actions]

E2E HTML report is ready: https://life-ustc.github.io/e2e-snapshot-artifacts/reports/31942581528/index.html
All reports: https://life-ustc.github.io/e2e-snapshot-artifacts/