feat(platform): add audit logs and activity feed

backend/hermes/app/api/auth.py

@@ -1,5 +1,6 @@
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
+from starlette.requests import Request
 
 from app.core.security import (
     create_access_token,
@@ -12,6 +13,7 @@ from app.models.user import User
 from app.repositories.user_repository import UserRepository
 from app.schemas.rbac import CurrentUserResponse
 from app.schemas.user import LoginRequest, LoginResponse
+from app.services.audit_service import write_audit_log
 
 router = APIRouter(
     prefix="/auth",
@@ -22,23 +24,50 @@ router = APIRouter(
 @router.post("/login", response_model=LoginResponse)
 def login(
     login: LoginRequest,
+    request: Request,
     db: Session = Depends(get_db),
 ):
     user = UserRepository.get_by_username(db, login.username)
 
     if not user:
+        write_audit_log(
+            db,
+            action="auth.login.failed",
+            entity_type="auth",
+            entity_label=login.username,
+            actor_username=login.username,
+            request=request,
+        )
         raise HTTPException(
             status_code=401,
             detail="Ungültige Anmeldedaten",
         )
 
     if not verify_password(login.password, user.password_hash):
+        write_audit_log(
+            db,
+            action="auth.login.failed",
+            entity_type="auth",
+            entity_label=login.username,
+            actor_user_id=user.id,
+            actor_username=user.username,
+            request=request,
+        )
         raise HTTPException(
             status_code=401,
             detail="Ungültige Anmeldedaten",
         )
 
     token = create_access_token(user.username)
+    write_audit_log(
+        db,
+        action="auth.login.success",
+        entity_type="auth",
+        entity_id=user.id,
+        entity_label=user.username,
+        actor=user,
+        request=request,
+    )
 
     return {
         "access_token": token,