Audit log: who did what, when

[MrImmortal09]

Context

Every privileged action (role change, report resolution, user ban, event edit, email change) should be auditable. This is both a security and a trust feature.

Acceptance criteria

• AuditLog model: { id, actorId, action, targetType, targetId, diff (json), ip, userAgent, createdAt }
• Helper logAudit(...) called from every mutation in /admin
• /admin/audit read-only table viewable by superadmin only
• Entries are append-only (no delete), retained for 2 years

Depends on #7.

[Ewan-Dkhar]

/assign

[mini-walkerx]

✅ Successfully assigned to @Ewan-Dkhar.

You have 3 hours to complete this issue (Deadline: Sun, 12 Apr 2026 17:10:15 GMT).

[mini-walkerx]

🔗 PR #47 by @Ewan-Dkhar is now linked to this assignment. The deadline timer is paused while the PR is open.