log every auth attempt that names an identity the platform does not know

src/servers/bootstrap.ts

@@ -3,6 +3,7 @@ import { DATA_PATH, ensureItemDirs } from './data-path';
 import { ensureToolLoader } from './ensure-tool-loader';
 // Queue is now owned by the sidecar process
 import { startChatEventRetention } from './api/chat/retention';
+import { loadKnownUsers } from './_middlewares/known-users';
 
 mkdirSync(DATA_PATH, { recursive: true });
 ensureItemDirs();
@@ -13,6 +14,10 @@ ensureItemDirs();
 
   startChatEventRetention();
 
-
-
+  // Snapshot every account at launch, so the auth audit can tell the owner from a stranger without a
+  // query on an unauthenticated path. A failure here is not fatal: isKnownIdentity() falls back to the
+  // database, and the platform must still boot with Postgres briefly unavailable.
+  await loadKnownUsers()
+    .then((count) => console.log(`[auth] ${count} known identit${count === 1 ? 'y' : 'ies'} loaded`))
+    .catch((err) => console.error('[auth] could not load known users at launch:', String(err)));
 })();