feat(security): Add audit logging and secure password reset tokens

Commit notes

Admin Audit Logging: - Add audit-log service for tracking sensitive operations - Log admin user deletion actions with details - Log admin payout processing actions - Stores events in analytics_events table with structured metadata

Password Reset Token Security: - Hash tokens before database storage using SHA-256 - Store hash instead of plaintext token (prevents DB leak exposure) - Hash incoming token before lookup (timing-safe verification) - Use generateSecureToken(32) for 256-bit entropy

Both changes address HIGH priority items from security review.

Co-authored-by: armin.naimi <[email redacted]>