Append-Only Audit Log

Add an append-only audit log for actions an admin or a user takes on sensitive records. EVENTS Actions: [CREATE, UPDATE, DELETE, LOGIN, EXPORT, ROLE CHANGE] Who: actor id, actor type (user, system, support impersonation) What: entity type, entity id, before and after for updates Tenant: [ORG ID] DELIVER 1) The table. No updated_at. No update or delete grants for the application role. Say how a retention job is allowed to delete old rows without giving the app that power (a separate role). 2) What we store on update: changed fields only, not the whole row, and how we redact secrets (tokens, password hashes) before insert. 3) The helper function signature in TypeScript and the rule that the audit insert is in the same transaction as the change. 4) Impersonation: store both the support agent and the user they acted as. 5) A query for "who changed this record" and the index that makes it cheap. 6) What must never be logged: full card numbers, secrets, the contents of a message if the product is private. List the denylist. Do not log inside a catch-all middleware that sees passwords.