fix: refactor auth, token, and audit logging

[appleboy]

• Refactor audit logging to centralize entry construction, reuse timestamps, and remove duplicated enrichment logic across async and sync paths
• Extract common token to client enrichment into a shared helper and reuse it for paginated and non-paginated queries
• Replace hardcoded token category and status strings with typed model constants throughout the token service
• Adjust device code exchange to return access denied for invalid codes instead of treating them as expired
• Update authorization checks to use client type constants instead of string literals
• Improve sensitive field masking by defining shared full and partial mask field lists
• Add a helper for logging authentication failures and simplify repeated audit logging logic
• Fix test coverage and edge cases for device code hashing, user code normalization, and token assertions
• Improve error handling by using typed database errors instead of string matching
• Simplify unique username generation logic for OAuth users

[codecov]

Codecov Report

❌ Patch coverage is 48.75000% with 41 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/services/user.go	27.27%	16 Missing ⚠️
internal/services/token.go	61.53%	14 Missing and 1 partial ⚠️
internal/services/audit.go	33.33%	10 Missing ⚠️

📢 Thoughts on this report? Let us know!

[Copilot]

Pull request overview

Refactors authentication/audit logging and token issuance paths to reduce duplication, standardize constants, and adjust OAuth device-code error semantics.

Changes:

• Centralizes audit log record construction (shared enrichment/masking + shared timestamps) and adds a helper for auth failure audit logging.
• Reuses a shared helper to enrich token listings with client metadata (paginated and non-paginated).
• Replaces token status/category and client type string literals with typed/constants, and updates device-code exchange behavior + related tests.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
internal/services/audit.go	Introduces shared audit log builder and shared masking field lists.
internal/services/authorization.go	Switches client type checks to shared client type constants.
internal/services/device_security_test.go	Tightens device-code hashing negative test to ensure length checks are exercised.
internal/services/device_test.go	Fixes user-code normalization test to actually test lowercase input.
internal/services/token.go	Adjusts device-code exchange error mapping, replaces token constants, and extracts client-enrichment helper for token listings.
internal/services/token_client_credentials_test.go	Updates expectations to use typed token status/category constants.
internal/services/token_test.go	Updates expectations for device-code exchange error and typed token constants.
internal/services/user.go	Adds shared auth-failure audit helper, improves username generation, and refactors duplicate-email detection.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.