fix(security-events): scope events by org

[Nav-Prak]

Purpose / Description

Scope security-event reads to the caller's organization so a tenant admin cannot list another organization's security events.

This is part of the AUDIT2 tenant-scoping work and is split out from the closed broader tenant-scope PR #1184 to keep the security-events change independently reviewable.

Fixes

• Refs Fix tenant scoping for review, eval, audit, and security events #1184
• Addresses AUDIT2 tenant-scoping for security-events admin paths

Approach

This change stamps security events with an org_id and filters the admin security-events query by the current admin's org.

• Resolves the actor's organization when emitting security events.
• Adds org filtering to the admin get_security_events query.
• Adds an existing-deployment ClickHouse migration for security_events.org_id and its bloom-filter index.
• Preserves org-less/global behavior when an event cannot be attributed to a known user.
• Attributes wrong-password failures for existing users to that user so tenant admins can see failed login attempts for their own users.
• Keeps unknown-identifier login failures orgless/global.

How Has This Been Tested?

Targeted security-events tenant-scope tests:

cd observal-server && uv run --with pytest --with pytest-asyncio --with pyyaml \
  --with typer --with rich --with hypothesis --with pyarrow \
  pytest ../tests/test_tenant_scope_security_events.py -q

Result: security-events tenant-scope tests passed, including schema migration coverage and login-failure attribution for both /login and /token.

Lint/format:

uv run --with ruff==0.15.10 ruff check \
  observal-server/services/security_events.py \
  observal-server/api/routes/admin/org.py \
  observal-server/api/routes/auth.py \
  observal-server/services/clickhouse/schema.py \
  tests/test_tenant_scope_security_events.py

uv run --with ruff==0.15.10 ruff format --check \
  observal-server/services/security_events.py \
  observal-server/api/routes/admin/org.py \
  observal-server/api/routes/auth.py \
  observal-server/services/clickhouse/schema.py \
  tests/test_tenant_scope_security_events.py

Also re-ran adjacent auth/security and security-events suites as part of split verification; no regressions were found.

Checklist

Please, go through these checks before submitting the PR.

• You have a descriptive commit message with a short title (first line, max 50 chars).
• You have commented your code, particularly in hard-to-understand areas
• You have performed a self-review of your own code
• UI changes: include screenshots of all affected screens (in particular showing any new or changed strings)

[codecov]

Codecov Report

❌ Patch coverage is 89.28571% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
observal-server/services/security_events.py	88.00%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!