fix(audit): give the audit trail the names that make it readable

Migration 029 made `actor_id`/`target_id` non-FK on the stated grounds that
"the record must survive the actor's account being removed, which is exactly
when it is most likely to be wanted". All eleven call sites then passed None
for both name columns — so what survived a deletion was a bare uuid resolving
to nothing: the guarantee, minus the only thing that made it useful.

`record` now resolves whatever the caller omitted, in one query, so no call
site can forget. `me::delete_account` passes its names explicitly because it
has already hard-deleted the row by then — that is the one record a host is
most likely to be reading the next morning ("whose photos disappeared?").

Also: `actor_role` is written with `as_str()` rather than
`format!("{actor_role:?}")`. The Debug spelling is not a stable wire format,
so a derive change or a renamed variant would have silently started writing a
different string into a column nothing validates.

Migration 029's header lists three action slugs (`promote_user`,
`demote_user`, `delete_user`) that no call site has ever emitted, and it
cannot be corrected — editing an applied migration changes its checksum and
crash-loops every database that ran it. The real list, verified against the
call sites, is documented in this module instead, along with the fact that
there is no read endpoint and the query to use by hand.

A NULL name fails silently, so it is now asserted: names resolved from ids,
names surviving the row's deletion, and a row still written when neither can
be resolved (an audit write must never fail the action it records).

backend/src/handlers/me.rs

@@ -248,15 +248,21 @@ pub async fn delete_account(
     ));
 
     // Audited like the host actions it resembles, with the actor and target being the same person.
+    //
+    // The names are passed EXPLICITLY here, unlike every other call site. `audit::record` resolves
+    // a missing name by looking the id up in `"user"` — and this handler has just hard-deleted that
+    // row, so the lookup would find nothing and write the NULL that makes the record unreadable.
+    // This is the row most likely to be read later ("whose photos disappeared?"), and migration 029
+    // made these columns non-FK precisely so it would survive the deletion.
     crate::services::audit::record(
         &state.pool,
         auth.event_id,
         auth.user_id,
-        None,
+        Some(&user.display_name),
         user.role.clone(),
         "delete_account",
         Some(auth.user_id),
-        None,
+        Some(&user.display_name),
         Some(serde_json::json!({ "uploads_removed": files.len() })),
     )
     .await;