fix(audit): keep personal data and credentials out of audit events

Anonymize the audit events of a deleted user, store only the ID and
name of other users, and drop the metadata copy of actor_email.
Store URLs without query strings, registries without user info, and
the exception class instead of raw SSH errors.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

bootstrap/helpers/audit.php

@@ -53,6 +53,27 @@ if (! function_exists('auditLog')) {
     }
 }
 
+if (! function_exists('auditUrl')) {
+    /**
+     * Scheme, host, port and path of a URL, without user info, query string or fragment.
+     */
+    function auditUrl(mixed $url): ?string
+    {
+        if (! is_string($url) || $url === '') {
+            return null;
+        }
+
+        $parts = parse_url($url);
+        if (! is_array($parts) || ! isset($parts['scheme'], $parts['host'])) {
+            return '[invalid-url]';
+        }
+
+        return $parts['scheme'].'://'.$parts['host']
+            .(isset($parts['port']) ? ':'.$parts['port'] : '')
+            .($parts['path'] ?? '');
+    }
+}
+
 if (! function_exists('auditChangedFields')) {
     /**
      * Names of the attributes that the next save() will really change, without timestamps.