Restrict workspace settings to administrators, add demo countries, Helm chart and instance event log

Employees keep schedule editing but can no longer change workspace preferences or existing
scheduling-directory entries (enforced by the server, hidden in the UI). Demo accounts live in
Cyprus, the United Kingdom and Armenia with matching bank holidays. A Helm chart deploys the
service with a pre-upgrade migrate hook. Refused SSO sign-ins are stored with their support
reference as instance events and searchable on the instance administration page.

Co-Authored-By: Claude <noreply@anthropic.com>

src/store.rs

@@ -282,6 +282,14 @@ impl Store {
                 &[&actor, &action, &details],
             )
             .await?;
+        if action == "login.failed" {
+            // Anonymous callers can create these rows, so only the newest few thousand are kept.
+            self.db
+                .raw(
+                    "DELETE FROM meguri__instance_audit WHERE action='login.failed' AND id<=COALESCE((SELECT id FROM meguri__instance_audit WHERE action='login.failed' ORDER BY id DESC OFFSET 2000 LIMIT 1),0)",
+                )
+                .await?;
+        }
         Ok(())
     }
     pub async fn audit(&self, workspace: Uuid) -> Result<Vec<Value>> {