ENG-10376 docs: add enterprise auth audit hook page

[FarhanAliRaza]

Summary

Documents the new AuthPlugin(audit=...) observe-only audit hook (implemented in reflex-dev/reflex-enterprise#200, shipping in reflex-enterprise 0.9.3):

• New page docs/enterprise/auth/audit.md — configuration (callable / import-path string, eager validation), the action/outcome taxonomy tables, the AuditContext field reference, and the semantics users need to know: observe-only + fail-open, awaited inline (keep hooks fast), what is and isn't audited, event_handler/allowed volume, redaction responsibility, popup-flow event pairing, and writing events into app state via context.state.
• Registered in the enterprise sidebar (Authentication → "Auditing Auth Actions") and in docs/enterprise/overview.md's Authentication block (count 6 → 7).

Notes

• Content mirrors the reflex_enterprise.auth.audit module docstring and was validated against the implementation (all snippets exercised by the unit/integration tests in the enterprise PR).
• Should land alongside / after reflex-dev/reflex-enterprise#200; the page is marked "New in reflex-enterprise v0.9.3.".

Testing

• enterprise.auth.audit.path and the sidebar entry verified to resolve via reflex_docs import (docgen auto-generates the page from the md tree; /enterprise/auth whitelist prefix covers the route).

[greptile-apps]

Greptile Summary

Adds documentation for the reflex-enterprise authentication audit hook.

• Documents hook configuration, lifecycle and access-decision events, context fields, redaction, state updates, volume, and popup behavior.
• Registers the audit page in the enterprise authentication sidebar.
• Adds the audit hook to the enterprise feature overview and updates the authentication feature count.

Confidence Score: 5/5

The documentation-only PR appears safe to merge, with no concrete blocking or non-blocking defects identified.

The new markdown page follows the repository’s documentation routing conventions, its sidebar namespace resolves through the existing generated-page mechanism, and the overview count matches the seven listed authentication features.

Important Files Changed

Filename	Overview
docs/enterprise/auth/audit.md	Adds a comprehensive audit-hook guide with configuration examples, contract details, event taxonomy, context fields, and operational guidance; no actionable defect was established.
docs/app/reflex_docs/templates/docpage/sidebar/sidebar_items/enterprise.py	Adds the generated audit page route to the Authentication sidebar using the established namespace and routing convention.
docs/enterprise/overview.md	Adds the Audit Hook feature card and consistently increases the Authentication feature count from six to seven.

_{Reviews (1): Last reviewed commit: "ENG-10376 docs: add enterprise auth audi..." | Re-trigger Greptile}

[codspeed-hq]

Merging this PR will not alter performance

✅ 26 untouched benchmarks
⏩ 8 skipped benchmarks¹

---

_{Comparing FarhanAliRaza:farhan/eng-10376-audit-hook-docs (2e4ade4) with main (b9d112d)}

Footnotes

1. 8 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2e4ade4a58

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Stop promising direct JSON serialization

For a hook that passes the event directly to a JSON/SIEM encoder, this claim is incorrect: frozen dataclasses are not JSON-serializable by default, and this context also contains live State, AuthUserState, and EventHandler objects plus an arbitrary payload. Standard encoders will raise TypeError, contradicting a central advertised use case. Clarify that callers must explicitly project the context to JSON-safe fields, as the preceding paragraph recommends, rather than implying the event itself can be serialized.

Useful? React with 👍 / 👎.