Add audit reauthentication as its own event and improve diagnostics

[labkey-bpatel]

Rationale

Nothing recorded that a reauthentication happened. SSO reauth wrote no audit event at all, and local reauth wrote a "logged in" event, which misstates what happened — no session is created and the user was already signed in. On the failure side, every distinct reauthentication failure produced the same "wrong user reauthenticated" message, with nothing in the server log at all, so an administrator hunts for a user mismatch that usually never happened.

Related Pull Requests

• Document the SameSite requirement for SAML reauthentication server#1472 — documents the SameSite requirement behind the reauthentication failure these messages now describe.
• LabKey/premiumModules#692 — records electronic-signing reauthentication through this same audit accounting. Merges together with this PR.

Changes

• Add a REAUTHENTICATED user audit event and auditReauthSuccess(), recorded from each path that completes a reauthentication. finalizePrimaryAuthentication() takes a reauth flag that suppresses the "logged in" event which previously misstated what happened.
• Split the single "wrong user reauthenticated" error into three, distinguishing a browser that is no longer signed in, and an identity matching no LabKey user account, from a genuinely different user. setReauthUser() keeps its existing name, void return, and signature.
• Log a warning when reauthentication fails in a way an administrator can act on, naming the identities involved and the likely cause.
• Note on activity counting: UserManager.getAuthCount() counts audit events matching "logged in", so suppressing that event means reauthentication no longer inflates it. LastLogin is unchanged by this PR and still updated on reauthentication, so the recentUserCount usage metric and the LastLogin column in the Users grid still count it as recent activity.