feat(audit): comprehensive audit logging & compliance reporting

[walexjnr]

Closes #25

Summary

Adds a comprehensive, immutable append-only audit logging module (src/modules/audit) that captures all system activity for compliance, security investigation and regulatory reporting.

What's included

• AuditLog entity — append-only (deliberately no @UpdateDateColumn), indexed for search by user, action, resource type and date. Captures timestamp, actor + role, action, outcome, resource type/id, HTTP method/path/status, duration, IP/user-agent, correlation id, and beforeState/afterState snapshots for data-change events.
• Global interceptor (AuditInterceptor, registered via APP_INTERCEPTOR) — records every HTTP request/response on both success and failure, deriving category (user/admin/system/data-change/security), resource, and outcome. Persistence is fire-and-forget so audit capture stays off the request's critical path and adds negligible latency; a persistence failure is logged, never thrown.
• AuditService — append-only writes, paginated/filterable search (user, action, category, outcome, resource, date range), a recent-activity feed for the security dashboard, GDPR per-user export, a 7-year retention constant with archival-candidate lookup, and compliance report generation.
• Compliance reports — POST /audit/reports generates transaction / user-activity / admin-action / security reports and streams them as a download in CSV (RFC 4180), PDF, or JSON. The PDF is produced by a small self-contained writer, so no new runtime dependency is added.
• Admin-only read API — GET /audit/logs, GET /audit/logs/:id, GET /audit/dashboard/activities (last 100), GET /audit/export/:userId, guarded by JwtAuthGuard + RolesGuard + @Roles(ADMIN). There is intentionally no create/update/delete endpoint.
• Docs — docs/audit-logging.md covers capture, immutability (incl. DB-level REVOKE), retention, the API, reports, and GDPR.

Acceptance criteria

• Append-only audit log entity
• Global interceptor captures all API requests/responses
• GET /audit/logs returns paginated, filtered records
• Records include timestamp, user, action, resource, before/after state
• Search by user, action type, date range, resource type
• POST /audit/reports generates compliance reports (PDF/CSV, plus JSON)
• Immutability: no update/delete path (entity + service + API), DB hardening documented
• Retention: 7-year minimum (AUDIT_RETENTION_YEARS) with cold-storage archival lookup
• Unit tests for audit capture logic (module coverage ~94%, >80%)
• Real-time dashboard endpoint returns the last 100 activities
• Low overhead: audit write is off the request critical path (fire-and-forget)

Verification

Ran the repository's CI steps locally: npx tsc --noEmit and npm run build both pass, eslint is clean on the new files, and the audit unit suite passes (26 tests). GDPR data-export and deletion-tracking are covered as noted in the docs.