Add activity logs, sidebar badges, and logout with working alert colors.

Record auth audits and surface them in Activity, poll sidebar counts without resetting idle, and add a profile logout path plus theme red/green/blue tokens so failure badges render.

service/internal/api/groups_handlers.go

@@ -34,6 +34,7 @@ var allowedPermissions = map[string]struct{}{
 	"users.manage":    {},
 	"secrets.manage":  {},
 	"roles.manage":    {},
+	"logs.read":       {},
 }
 
 func groupsGetHandler(configDir string) http.HandlerFunc {
@@ -89,6 +90,19 @@ func groupsUpsertHandler(configDir string) http.HandlerFunc {
 			return
 		}
 
+		action := "group_create"
+		if updated {
+			action = "group_update"
+		}
+		appendAuthAudit(
+			configDir,
+			action,
+			settings.AuthAuditOutcomeSuccess,
+			settings.AuthAuditCategoryGroup,
+			actorUsernameFromRequest(request),
+			payload.Group.Name,
+			"",
+		)
 		writeJSON(writer, http.StatusOK, groupsResponse{Groups: settingsPayload.Groups})
 	}
 }
@@ -137,6 +151,15 @@ func groupsDeleteHandler(configDir string) http.HandlerFunc {
 			return
 		}
 
+		appendAuthAudit(
+			configDir,
+			"group_delete",
+			settings.AuthAuditOutcomeSuccess,
+			settings.AuthAuditCategoryGroup,
+			actorUsernameFromRequest(request),
+			name,
+			"",
+		)
 		writeJSON(writer, http.StatusOK, groupsResponse{Groups: settingsPayload.Groups})
 	}
 }