05/06 Fix some notable and quality issues

app/models/api_token.py

@@ -76,6 +76,11 @@ class RefreshToken(db.Model):
         """
         Look up a refresh token by its raw value.
         Returns the RefreshToken row if valid and unexpired, else None.
+
+        Expired rows are not deleted here — passive cleanup runs in the
+        login route (api/auth.py) each time a user authenticates, removing
+        all expired/revoked tokens for that user.  This keeps the table tidy
+        without requiring a dedicated cron job.
         """
         import hashlib
         hashed = hashlib.sha256(raw_token.encode()).hexdigest()

app/models/audit.py

@@ -16,8 +16,8 @@ class AuditLog(db.Model):
     username     = db.Column(db.String(100), nullable=False)          # snapshot at time of action
     user_role    = db.Column(db.String(20),  nullable=False)          # snapshot at time of action
     # What happened
-    action       = db.Column(db.String(50),  nullable=False)          # CREATE / UPDATE / DELETE / LOGIN / LOGOUT / EXPORT
-    entity_type  = db.Column(db.String(50),  nullable=False)          # User / Facility / Area / Template / Inspection / Issue / …
+    action       = db.Column(db.String(50),  nullable=False, index=True)          # CREATE / UPDATE / DELETE / LOGIN / LOGOUT / EXPORT
+    entity_type  = db.Column(db.String(50),  nullable=False, index=True)          # User / Facility / Area / Template / Inspection / Issue / …
     entity_id    = db.Column(db.Integer,     nullable=True)           # PK of the affected record (NULL for bulk ops)
     entity_label = db.Column(db.String(255), nullable=True)           # Human-readable identifier snapshot
     # Extra context stored as free-text (key=value pairs, comma-separated)