Audit refused sign-in attempted address search

Found during the Task 8224 UI check on a local stack. 1. Make a refused sign-in findable by the address that was attempted. Searching "nobody@example.org" in Audit › Activity should find that address's `login_failed` records. Today `data.identifier` is not in the search text, so only "sign"/"refused" finds them. 2. A refusal that names an attempt is actorless (`user_id IS NULL`). Since Task 8224 it is also left out of the System facet, so no actor chip reaches it. Decide whether the actor facet should offer attempted addresses, or whether a known user's chip should include refusals of their email. 3. In the operator view, a refusal for an unknown address shows the org "Operator" (`UNATTRIBUTED_SIGN_IN_ORG_ID`). It should read as unattributed, not as the operator org. Out of scope: the sign-in fold; Sessions; the refused-disc rule (Task 8224). Done means: searching an attempted address returns its refusal records, with an API test; the facet decision is recorded; `./dc check quick` is green.

Lane fix: bumped test_alembic_head pin to 202610201300. API suite (25215), web vitest, top-level guards and quick gate green; PR #6411 re-queued at 0c57a0d. Refusals searchable by address; known-user chip reaches them; unknown reads Unattributed.