fix: add security_settings.created_at column

Migration 020 created the security_settings table with updated_at /
updated_by but no created_at / created_by columns. Query code
(database/queries/security_settings.go) SELECTs and INSERTs both
create-side fields, causing "failed to initialize default security
settings" at server startup — the dashboard's security panel then
shows hardcoded defaults instead of DB-backed values.

Adds both columns with NOT NULL + DEFAULT NOW() on created_at and a
nullable FK to users on created_by, matching the updated_by shape.
No backfill scaffolding (no live clients per release stance).

Closes AUDIT_TASKS.md §4.

server/internal/database/migrations/034_add_security_settings_created_at.down.sql

@@ -0,0 +1,5 @@
+-- Reverses migration 034.
+
+ALTER TABLE security_settings
+    DROP COLUMN IF EXISTS created_by,
+    DROP COLUMN IF EXISTS created_at;

server/internal/database/migrations/034_add_security_settings_created_at.up.sql

@@ -0,0 +1,9 @@
+-- Migration 034: Add created_at and created_by to security_settings
+-- The table was created in migration 020 with updated_at/updated_by but not
+-- the create-side columns. Query code (security_settings.go) selects and
+-- inserts created_at / created_by, causing "failed to initialize default
+-- security settings" at startup. Doctrine: AUDIT_TASKS.md §4.
+
+ALTER TABLE security_settings
+    ADD COLUMN IF NOT EXISTS created_at TIMESTAMP NOT NULL DEFAULT NOW(),
+    ADD COLUMN IF NOT EXISTS created_by UUID REFERENCES users(id);