Add security event logging to my app. Instrument the events that matter for detecting and investigating account abuse: successful logins, failed login attempts, password changes and resets, email changes, 2FA enrollment and removal, role or permission changes, account deletions, and (if the app has them) refunds and payout changes. For each event, log: timestamp, event type, the account involved, the source IP, and the outcome. Never log passwords, tokens, session IDs, full credit card numbers, or reset links. Use the logging setup already in the project (or add simple structured logging if none exists). Where it's cheap, surface suspicious events to the user ("a new sign-in to your account" email on login from a new device or location is the standard one). Do not log request bodies wholesale. Do not add an external logging service unless one is already configured; file or stdout logging is fine to start. Keep log volume sane: security events only, not every request. Give me a table of events now logged and their fields. Then a verification pass: perform a failed login, a successful login, and a password change with a test account and show me the resulting log lines, confirming no secrets appear in them.