feat(logs): admin changes and logins are recorded on the Logs page

The Logs page shows who added, changed or deleted a compute, from web
or API, and every login, failed login, lockout and logout, with the
client address and a Result column (Done, Failed, Unknown for older
rows). A failed change is recorded with its reason and the error still
reaches the user; a refused one is recorded too.

- logs.audit.write saves each row in its own savepoint and never
  raises, so a log write cannot break or undo the action it records.
  The audit() context manager writes one row when the change ends.
- Logs gains success and ip; user, host and instance are wider and
  date is indexed. The page orders by date then id.
- A compute edit names the changed fields; an edit that changes
  nothing writes no row, and an empty password field is no change.
- A compute's VMs leaving the panel get a system row each: owners
  kept on the Removed VMs page, moved to another compute, restored,
  left without owners, or the removed record expired.
- Job rows carry the result. A job's log entry that cannot be
  computed is logged and skipped instead of rolling back the finish
  (test_service.py changes this on purpose).
- Logins are recorded by signal receivers; CustomLoginView is removed
  and the plain LoginView is used. A wrong OTP code is a failed login,
  counted by django-axes toward the lockout.

Panel records and host-side objects follow in the next layers.

computes/utils.py

@@ -9,6 +9,7 @@ from django.db import transaction
 from django.utils import timezone
 from computes.models import Compute
 from instances.models import Instance, InstanceTombstone
+from logs.audit import write
 from operations import claims
 from operations.models import Claim
 
@@ -45,6 +46,10 @@ def libvirt_instance_lock(instance):
         yield
 
 
+def _log(inst, what):
+    write("-", inst.compute.name, "", f"VM {inst.name} ({inst.uuid}): {what}", True)
+
+
 def _move_ownership(source, target):
     """Give target the owners and template flag of source; a user's rights are merged."""
     for ui in UserInstance.objects.filter(instance=source):
@@ -70,6 +75,7 @@ def forget(inst):
     elsewhere = Instance.objects.filter(uuid=inst.uuid).exclude(compute_id=inst.compute_id).first()
     if elsewhere:
         _move_ownership(inst, elsewhere)
+        _log(inst, f"owners moved to {elsewhere.compute.name}")
     else:
         _bury(inst)
     inst.delete()
@@ -82,7 +88,9 @@ def _bury(inst):
     ]
     if owners or inst.is_template:
         InstanceTombstone.objects.create(uuid=inst.uuid, name=inst.name, is_template=inst.is_template, owners=owners)
-        logger.info("Instance %s (%s) disappeared; ownership kept", inst.name, inst.uuid)
+        _log(inst, "owners kept on the Removed VMs page")
+    else:
+        _log(inst, "left the panel (no owners)")
 
 
 def _restore(inst):
@@ -103,7 +111,7 @@ def _restore(inst):
         inst.is_template = True
         inst.save(update_fields=["is_template"])
     InstanceTombstone.objects.filter(uuid=inst.uuid).delete()
-    logger.info("Instance %s (%s) is back; ownership restored", inst.name, inst.uuid)
+    _log(inst, "owners restored")
 
 
 def refresh_instance_database(compute):
@@ -187,7 +195,10 @@ def refresh_instance_database(compute):
                 #    compute is a copy and gets no owners; otherwise a tombstone's
                 #    ownership is restored.
                 retention = getattr(settings, "INSTANCE_OWNERSHIP_RETENTION_DAYS", 30)
-                InstanceTombstone.objects.filter(removed__lt=timezone.now() - timedelta(days=retention)).delete()
+                expired = InstanceTombstone.objects.filter(removed__lt=timezone.now() - timedelta(days=retention))
+                for t in expired:
+                    write("-", "-", "", f"VM {t.name} ({t.uuid}): removed record expired", True)
+                expired.delete()
                 for uuid, name in host_domains.items():
                     if uuid not in db_uuids:
                         inst, created = Instance.objects.get_or_create(