Security-sensitive actions leave no audit trail

A fully-built extension point (SecurityEventLogger / NullSecurityEventLogger / RecordingSecurityEventLogger, wired into create_app() via AuditExtension.init_app(), built on the exact same pattern as MailerExtension in email.py) already proves itself at one call site: login() already calls audit.log("login_success", ...) and audit.log("login_failed", ...). But password_reset_confirm(), disable_2fa(), and revoke_all_sessions() -- each at least as security-relevant as a login attempt -- call it nowhere at all, leaving incident response and compliance with no record of these actions.

The audit.py extension point exists and works, but most of the security-relevant call sites in routes.py do not call audit.log(...).

1. Complete a successful POST /auth/password-reset/confirm.
2. Inspect recorded audit events (via the test double, RecordingSecurityEventLogger).
3. Observe: 0 "password_reset" events recorded -- expected exactly 1.

This is the "missing architectural extension point" case with a twist: the extension point itself is not missing -- it is fully built and already proven to work at one call site. The actual work is recognizing the pattern and applying the same three-line addition consistently across the parts of the codebase that need it, which requires reading and understanding several files (audit.py, email.py for the pattern it mirrors, and every relevant route in routes.py), not just one.

Read audit.py's module docstring and compare login()'s two audit.log(...) calls against the shape of the calls you will need to add elsewhere. Decide what metadata (the free-form dict parameter) should carry for each new event type -- e.g. a password reset's audit event probably does not need the new password, but might reasonably note how many sessions were revoked as a result.