Add AuditLog table and Prisma audit extension

prisma/migrations/20260911120000_add_audit_log/migration.sql

@@ -0,0 +1,30 @@
+-- CreateTable
+CREATE TABLE "AuditLog" (
+    "id" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    "userId" TEXT,
+    "email" TEXT,
+    "roleId" INTEGER,
+    "roleName" TEXT,
+    "page" TEXT NOT NULL,
+    "action" TEXT NOT NULL,
+    "entity" TEXT,
+    "entityId" TEXT,
+    "before" JSONB,
+    "after" JSONB,
+    "ip" TEXT,
+
+    CONSTRAINT "AuditLog_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "AuditLog_createdAt_idx" ON "AuditLog"("createdAt");
+
+-- CreateIndex
+CREATE INDEX "AuditLog_roleId_idx" ON "AuditLog"("roleId");
+
+-- CreateIndex
+CREATE INDEX "AuditLog_action_idx" ON "AuditLog"("action");
+
+-- CreateIndex
+CREATE INDEX "AuditLog_page_idx" ON "AuditLog"("page");

prisma/schema.prisma

@@ -229,3 +229,27 @@ model ColorPalette {
 
   @@map("ColorPalette")
 }
+
+// Append-only audit trail of database mutations. Written centrally by the
+// Prisma extension in src/lib/db.ts; read by the admin Audit Log page.
+model AuditLog {
+  id        String   @id @default(uuid())
+  createdAt DateTime @default(now())
+  userId    String?
+  email     String?
+  roleId    Int?
+  roleName  String?
+  page      String
+  action    String
+  entity    String?
+  entityId  String?
+  before    Json?
+  after     Json?
+  ip        String?
+
+  @@index([createdAt])
+  @@index([roleId])
+  @@index([action])
+  @@index([page])
+  @@map("AuditLog")
+}