Add activity logs, sidebar badges, and logout with working alert colors.

Record auth audits and surface them in Activity, poll sidebar counts without resetting idle, and add a profile logout path plus theme red/green/blue tokens so failure badges render.

service/internal/api/users_handlers.go

@@ -137,6 +137,15 @@ func (app *App) usersCreateHandler(writer http.ResponseWriter, request *http.Req
 		return
 	}
 
+	appendAuthAudit(
+		app.ConfigDir,
+		"user_create",
+		settings.AuthAuditOutcomeSuccess,
+		settings.AuthAuditCategoryUser,
+		actorUsernameFromRequest(request),
+		username,
+		"",
+	)
 	writeJSON(writer, http.StatusOK, usersResponse{Users: toPublicUsers(store.Users)})
 }
 
@@ -254,6 +263,15 @@ func (app *App) usersPatchHandler(writer http.ResponseWriter, request *http.Requ
 		_ = app.Sessions.InvalidateUserSessions(userID)
 	}
 
+	appendAuthAudit(
+		app.ConfigDir,
+		"user_update",
+		settings.AuthAuditOutcomeSuccess,
+		settings.AuthAuditCategoryUser,
+		actorUsernameFromRequest(request),
+		target.Username,
+		"",
+	)
 	writeJSON(writer, http.StatusOK, usersResponse{Users: toPublicUsers(store.Users)})
 }
 
@@ -293,12 +311,14 @@ func (app *App) usersDeleteHandler(writer http.ResponseWriter, request *http.Req
 	adminCount := countAdministrators(store.Users)
 	remaining := make([]settings.UserCredential, 0, len(store.Users))
 	found := false
+	deletedUsername := ""
 	for _, user := range store.Users {
 		if user.ID != userID {
 			remaining = append(remaining, user)
 			continue
 		}
 		found = true
+		deletedUsername = user.Username
 		if userIsAdministrator(user) && adminCount <= 1 {
 			writeJSON(writer, http.StatusConflict, apiErrorResponse{
 				Error: "cannot delete the last administrator",
@@ -322,6 +342,15 @@ func (app *App) usersDeleteHandler(writer http.ResponseWriter, request *http.Req
 		_ = app.Sessions.InvalidateUserSessions(userID)
 	}
 
+	appendAuthAudit(
+		app.ConfigDir,
+		"user_delete",
+		settings.AuthAuditOutcomeSuccess,
+		settings.AuthAuditCategoryUser,
+		actorUsernameFromRequest(request),
+		deletedUsername,
+		"",
+	)
 	writeJSON(writer, http.StatusOK, usersResponse{Users: toPublicUsers(store.Users)})
 }