feat(5.6): observabilitate + jurnal aplicatie + lifecycle trimiteri blocate

Implementeaza PRD 5.6 complet (14 stories, TDD). Doua axe:

Lifecycle trimiteri blocate (Val A):
- submissions_admin.py: sterge/repune scoped (404 cross-account inaintea lui 409 stare)
- reactivare dedup peste `error` cu CAS (WHERE id=? AND status='error'), creds noi in
  submissions + accounts.rar_creds_enc; worker invalideaza sesiunea RAR la creds proaspete
  (JWT 30h vechi nu mai trimite cu parola gresita); camp aditiv `reactivated:true`
- retentie randuri blocate 30z; purge_expired exclude queued/sending; purge_after curatat
  la reactivare/requeue
- API DELETE /v1/prezentari/{id} + /repune (200+JSON); UI butoane + bulk + banner actionabil

Observabilitate:
- app/observ.py log_event: dublu canal app_events (DB) + RotatingFileHandler per-proces,
  redactare creds/PII la scriere (redact_pii/vin_partial)
- request_id middleware + X-Request-ID pe toate raspunsurile
- handler global excepții -> 500 envelope 6-chei + request_id (traceback doar in jurnal)
- audit cerere API (api_prezentari/api_auth_esuat) + audit worker (rar_login/tranzitii)
- tab "Jurnal" filtrabil scoped (non-admin doar contul sau); retentie jurnal 90z
- rar_error expus in GET /v1/prezentari/{id} (recovery observabil)

pytest -q: 741 passed, 0 failed. Docs: PRD raport VERIFY, contract endpointuri noi, ROADMAP.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/auth.py

@@ -19,7 +19,7 @@ import hashlib
 import secrets
 import sqlite3
 
-from fastapi import Header, HTTPException
+from fastapi import Header, HTTPException, Request
 
 from .config import get_settings
 from .db import get_connection
@@ -111,7 +111,28 @@ def _extract_key(x_api_key: str | None, authorization: str | None) -> str | None
     return None
 
 
+def _log_auth_esuat(request: Request | None, plaintext: str | None, motiv: str) -> None:
+    """Eveniment de jurnal pentru un esec de auth (US-004): IP + prefix cheie, NU cheia.
+
+    Best-effort (log_event inghite erorile). Import local: evita cuplarea la import-time
+    (observ -> db; auth -> db) si pastreaza auth.py importabil din CLI fara efecte.
+    """
+    from .observ import log_event
+    ip = None
+    if request is not None and request.client is not None:
+        ip = request.client.host
+    prefix = (plaintext[:8] + "…") if plaintext else None
+    log_event(
+        "api_auth_esuat",
+        nivel="WARNING",
+        cod="RAR_CREDS_INVALIDE" if plaintext else None,
+        mesaj=motiv,
+        context={"ip": ip, "key_prefix": prefix},
+    )
+
+
 def resolve_account_id(
+    request: Request,
     x_api_key: str | None = Header(default=None, alias="X-API-Key"),
     authorization: str | None = Header(default=None),
 ) -> int:
@@ -121,12 +142,14 @@ def resolve_account_id(
     - cheie invalida (prezenta) -> 401 (mereu, indiferent de flag)
     - fara cheie + flag off      -> cont implicit (id=1), back-compat
     - fara cheie + flag on        -> 401
+    Esecurile de auth (401) emit `api_auth_esuat` cu IP + prefix cheie (US-004).
     """
     settings = get_settings()
     plaintext = _extract_key(x_api_key, authorization)
 
     if plaintext is None:
         if settings.require_api_key:
+            _log_auth_esuat(request, None, "cheie API lipsa (prod)")
             raise HTTPException(status_code=401, detail="cheie API lipsa")
         return DEFAULT_ACCOUNT_ID
 
@@ -136,5 +159,6 @@ def resolve_account_id(
     finally:
         conn.close()
     if account_id is None:
+        _log_auth_esuat(request, plaintext, "cheie API invalida sau revocata")
         raise HTTPException(status_code=401, detail="cheie API invalida sau revocata")
     return account_id