Deleting any user who owned an API token or appeared in the audit log hit the users FK and returned 500. Tokens are revoked outright; audit history is kept but detached so the trail survives the account.