Harden authentication and session audit ingestion

[somethingwithproof]

Summary

• Supersedes conflicted PR Feature/auth session audit #64 with its original commits rebased onto the current develop branch.
• Captures authentication, authorization-denied, and completed-logout events using native Cacti plugin APIs.
• Adds fail-closed durable user_log ingestion with deterministic event identity, bounded retries, terminal dropped-row evidence, and database-clock activation.
• Makes authentication auditing opt-in and requires explicit admin CLI setup for local user_log indexes.
• Adds replay-safe, rate-proportional marker cleanup and idempotent external-file delivery.
• Protects the audit master switch, retention, external-file, authentication, and Syslog settings with Audit Log Admin.
• Bumps the plugin to 1.6 and removes obsolete compatibility helpers in favor of PHP 8.1+ idioms.

Validation

• Authentication/session executable-line coverage: 100% (343/343).
• Security, controller, Syslog queue, setup-default, and index-ownership tests pass.
• PHP syntax, PHP-CS-Fixer, and actionlint pass.
• Real-MySQL integration runs in the full Cacti CI workflow, including user_log timestamp and primary-key contract checks.
• Mandatory pre-push critical/high/medium review: PASS with no missing tests.

Operator note

Before enabling authentication auditing, run php plugins/audit/audit_auth_indexes.php. This keeps core-table DDL out of checkbox and poller paths.