refactor(storage): drive audit-log scan hint from the indexed-column set

[lakhansamani]

Refs #805. Takes the two parts of that issue that can be settled with evidence, and leaves the part that needs measurement open.

1. The scan-hint decision is now driven by an explicit indexed-column set

The ALLOW FILTERING decision was positional: len(clauses) > 1, plus a flag the timestamp bounds set. It knew nothing about which columns actually carry an index.

That is the coupling #805 identifies, and it is sharper than a perf nit: a hint-less equality against a column with no index is rejected by Cassandra, not merely slow. So dropping any index would silently turn a working filter into an error. Nothing could be removed until this was fixed.

buildAuditLogWhere now derives the hint from auditLogIndexedColumns. Three things force it:

1. an equality on a column not in the set;
2. any range restriction — a range on a non-primary-key column cannot be served by a secondary index even when the column has one, so this holds regardless of the set;
3. more than one restriction — one query, one index.

Adding or dropping an index is now a one-line change to the set.

The helper also returns the hint as a flag rather than baked into the clause, which deletes the strings.TrimSuffix(whereClause, " ALLOW FILTERING") dance the paged query needed (CQL grammar puts LIMIT before ALLOW FILTERING). Net simplification.

2. The Cassandra created_at index is dropped

It could never be used. A Cassandra secondary index serves equality only, and every query this table issues against created_at is a range:

• ListAuditLogs — created_at>=? / created_at<=?, already on the scan path
• DeleteAuditLogsBefore — created_at < ? ALLOW FILTERING (audit_log.go)

So it was pure write amplification on the highest-write table in the schema — a write per audit row, for an index no query could read.

This is non-destructive. Removing the CREATE INDEX IF NOT EXISTS stops new deployments from creating it; existing deployments keep theirs until dropped by hand. The CQL is in a comment at the removal site:

DROP INDEX IF EXISTS authorizer.authorizer_audit_log_created_at;

Automatic DROP INDEX on every boot would be destructive DDL run unattended, so it is deliberately not done.

Couchbase keeps its created_at GSI

#805 says "whatever is decided should be applied to both backends together". That is wrong for this column, and the PR deliberately diverges:

• N1QL serves range predicates from a GSI, unlike a Cassandra 2i.
• couchbase/audit_log.go puts ORDER BY created_at DESC on every ListAuditLogs query, which the index serves.
• DELETE ... WHERE created_at < $before is also index-served there.

Dropping it on Couchbase would regress exactly the query path it exists for. The AGENTS.md parity rule is about comparable query cost across backends, not identical index lists — and here identical lists would produce divergent cost.

3. Left open in #805

The action (~60 distinct values) and resource_type (~17) low-cardinality MV hotspots. Both predate #802's shape, and the right input is MV partition sizes measured on a real cluster, not a guess. With change (1) in place, acting on them later is a one-line edit to the set plus the CREATE INDEX removal.

Testing

• TestBuildAuditLogWhereAllowFilteringDecision — table test over the hint rule: single indexed equality stays index-served; two equalities take the hint; a created_at range always takes it; all six filters compose; empty-string filters are ignored rather than bound. Mutation-checked: reverting the range rule makes the created_at case fail.
• TestAuditLogIndexedColumnsMatchCreatedIndexes — reads provider.go and asserts the set matches the CREATE INDEX statements in both directions, and that created_at has not come back. Mutation-checked: re-adding created_at to the set fails it. This is the guard that keeps the Review audit_log secondary-index strategy on Cassandra/Scylla (low-cardinality hotspots) #805 coupling from re-forming.
• make test-scylladb against a real ScyllaDB container, three runs. Audit-log subtests 9/9 in every run.
• go build ./..., go vet ./..., go test ./internal/storage/db/cassandradb/ clean.

One flake seen, unrelated to this change

Run 1 of 3 had two failures — Org_Domain_Operations and User_SCIM_Fields — both green in runs 2 and 3, and both green on main and on #810's branch in earlier runs. They are assertion failures about a write not being visible on an immediate read (ListOrgDomainsByOrg returning 2 rows after a delete; IsActive=false not persisting), not driver errors, and they sit in OrgDomain / UpdateUser paths this diff does not touch — it changes audit-log query construction, removes one audit-log DDL statement, and adds a test file. Reported separately rather than hidden here; OrgDomain.org_id is a Scylla materialized view, so MV write-propagation lag is the likely cause.

Merge order

Needs a rebase after #811 (golang.org/x/net bump) lands — like #810, this branch inherits main's failing govulncheck, which is unrelated to its own diff.