feat(portal-bff): audit log foundation per ADR-0013 (#76)

## Summary

Lays down the append-only audit log per ADR-0013: schema declaration, first migration with role grants, NestJS `AuditWriter` service. Typed event-family methods, the separate `AUDIT_DATABASE_URL` pool, the retention job, and the live-DB integration tests are explicitly listed as "wired as features land" in the ADR's confirmation block — they ship when the matching feature ADRs do.

## What lands

**Prisma schema** ([`apps/portal-bff/prisma/schema.prisma`](apps/portal-bff/prisma/schema.prisma)):

- `multiSchema` preview enabled; datasource declares `public` + `audit` schemas.
- `AuditEvent` model: `id` (uuid), `createdAt`, `eventType` (free-form in v1), `audience` enum (`workforce | customer`), `actorIdHash`, `traceId`, `subject`, `outcome` enum (`success | failure | denied`), `payload` (jsonb).
- Indexes on `createdAt`, `eventType`, `traceId` — covering the three obvious query shapes.

**Migration** ([`prisma/migrations/*_init_audit_schema/migration.sql`](apps/portal-bff/prisma/migrations/20260510011453_init_audit_schema/migration.sql)):

- Standard Prisma `CREATE TABLE` / enums output, then the **append-only contract** re-applied explicitly:
  - `ALTER TABLE/TYPE OWNER TO audit_owner`.
  - `GRANT INSERT` to `audit_writer`, `SELECT` to `audit_reader`, **`SELECT, DELETE`** to `audit_archiver` (SELECT is needed to evaluate the `created_at` predicate of "delete older than retention" — Postgres requires SELECT on every column referenced in DELETE's WHERE).
  - `GRANT USAGE` on the enum types to all three roles (without it `audit_writer.INSERT` fails with "permission denied for type").
  - **No** GRANT for `UPDATE` / `TRUNCATE` to anyone — including `audit_owner` at runtime; only fresh schema migrations amend the table.

**Service** ([`apps/portal-bff/src/audit/`](apps/portal-bff/src/audit/)):

- `AuditWriter.recordEvent(input)` — single entry point. Wraps every INSERT in a transaction whose first statement is `SET LOCAL ROLE audit_writer`, so the role contract holds at runtime even from the otherwise-privileged BFF connection.
- `traceId` auto-resolved from the active OTel span (so audit row joins with traces and Pino logs on the same `trace_id`).
- `actorIdHash` auto-resolved from CLS (key `actorIdHash`) with explicit input-side override; `null` when neither is set (placeholder until ADR-0009 / ADR-0010 guards populate CLS).
- Errors propagate (no catch-and-swallow), per ADR-0013's "blocking writes: no audit ⇒ no action".

**Tests** — 8 unit tests on `AuditWriter` (mocked Prisma + CLS): role-locking ordering, input pass-through, `Prisma.JsonNull` for missing payload, CLS-vs-input precedence on `actorIdHash`, OTel trace capture, error propagation.

## End-to-end verification (manual, against local-dev Postgres)

```
INSERT under audit_writer:   ok
UPDATE under audit_writer:   permission denied for table events
DELETE under audit_writer:   permission denied for table events
DELETE under audit_archiver: ok, row removed (after the SELECT-grant fix)
```

## ADR-0013 §Confirmation rewritten

Two-block split: "wired in foundation PR" lists what landed here; "wired as features land" lists the typed event-family methods, AUDIT_DATABASE_URL connection split, startup self-test probe, retention purge job, salt-shared cross-correlation test, and live-DB role-contract integration tests — each anchored to the feature ADR that triggers it.

## Recovery for anyone with a pre-existing local-dev DB

If your local-dev Postgres already had the audit migration applied **before** the SELECT-grant fix, the archiver's DELETE will fail. Two options:

1. Apply the missing grant directly:
   ```bash
   psql "$DATABASE_URL" -c "GRANT SELECT ON audit.events TO audit_archiver;"
   ```
2. Or wipe the volume and re-migrate cleanly:
   ```bash
   ./infra/local/dev.sh down -v
   ./infra/local/dev.sh up
   pnpm --filter @apf-portal/source exec prisma migrate deploy   # or `cd apps/portal-bff && pnpm exec prisma migrate deploy`
   ```

Fresh DBs land with the corrected migration directly.

## Out of scope (separate PRs)

- Typed event-family methods (`signIn`, `signInFailed`, …) — added per matching feature ADR.
- `AUDIT_DATABASE_URL` separate connection pool — defense-in-depth, when production needs it.
- Startup self-test probe (deliberate failing UPDATE asserting rejection) — lands with the connection split.
- Retention purge job (`audit_archiver` daily cron) — phase-3b infra.
- Live-DB integration tests asserting the role contract — Testcontainers-style harness, separate PR.

## Test plan

- [ ] CI green on this PR.
- [ ] `prisma migrate deploy` succeeds on a fresh DB (the recovery instructions cover the SELECT-grant gap for already-migrated dev DBs).
- [ ] `psql -c "\dp audit.events"` shows the expected privilege matrix: `audit_owner=arwdDxtm/audit_owner`, `audit_writer=a/audit_owner`, `audit_reader=r/audit_owner`, `audit_archiver=rd/audit_owner`.
- [ ] BFF boots; calling `AuditWriter.recordEvent` from a controller (manual smoke once a real flow lands) writes to `audit.events` with the expected `trace_id` matching the request's Jaeger span.

---------

Co-authored-by: Julien Gautier <julien.gautier@apf.asso.fr>
Reviewed-on: #76

apps/portal-bff/src/audit/audit.service.ts

@@ -0,0 +1,76 @@
+import { Injectable } from '@nestjs/common';
+import { trace } from '@opentelemetry/api';
+import { ClsService } from 'nestjs-cls';
+import { PrismaService } from 'nestjs-prisma';
+import { Prisma } from '@prisma/client';
+import type { AuditEventInput } from './audit.types';
+
+/**
+ * AuditWriter — single entry point for ADR-0013 audit-log writes.
+ *
+ * Contract
+ * --------
+ * - **Append-only at the database level.** Every write runs inside a
+ *   transaction whose first statement is `SET LOCAL ROLE
+ *   audit_writer`. That role only has `INSERT` on `audit.events`
+ *   (per the migration that created the table); `UPDATE`, `DELETE`,
+ *   `TRUNCATE` all fail at the Postgres level even if the BFF
+ *   connection is otherwise privileged. The role is reset
+ *   automatically at transaction end.
+ *
+ * - **Fail loud, never swallow.** Per ADR-0013 §"Blocking writes":
+ *   no audit ⇒ no action. Callers must propagate the rejection up
+ *   so the requested action does not proceed when its audit trail
+ *   cannot be written. The service throws the underlying Prisma
+ *   error unchanged; do not wrap it in a catch-and-log block.
+ *
+ * - **trace_id and actor_id_hash are auto-resolved.** trace_id is
+ *   read from the active OTel span context (so the audit row joins
+ *   with the BFF request span and the Pino log lines on the same
+ *   request). actor_id_hash is read from the CLS context populated
+ *   by future auth guards (ADR-0009 / ADR-0010); v1 stores `null`
+ *   when no actor is established. Callers can override either by
+ *   passing them on `AuditEventInput`.
+ */
+@Injectable()
+export class AuditWriter {
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly cls: ClsService,
+  ) {}
+
+  async recordEvent(input: AuditEventInput): Promise<void> {
+    const traceId = trace.getActiveSpan()?.spanContext().traceId ?? null;
+    const actorIdHash =
+      input.actorIdHash ?? this.cls.get<string | undefined>('actorIdHash') ?? null;
+
+    await this.prisma.$transaction(async (tx) => {
+      // Lock the connection to audit_writer for the duration of this
+      // transaction. SET LOCAL is reset at COMMIT/ROLLBACK so the
+      // pool's next consumer sees the original role.
+      await tx.$executeRawUnsafe(`SET LOCAL ROLE audit_writer`);
+
+      await tx.auditEvent.create({
+        data: {
+          eventType: input.eventType,
+          audience: input.audience,
+          outcome: input.outcome,
+          subject: input.subject ?? null,
+          actorIdHash,
+          traceId,
+          payload: this.toJsonInput(input.payload),
+        },
+      });
+    });
+  }
+
+  // Prisma's `Json` field accepts `Prisma.JsonNull` (null literal in
+  // SQL JSONB) or a serialisable value; explicit `undefined` skips
+  // the column. Map `payload` accordingly.
+  private toJsonInput(
+    payload: AuditEventInput['payload'],
+  ): Prisma.InputJsonValue | typeof Prisma.JsonNull {
+    if (payload === undefined) return Prisma.JsonNull;
+    return payload as Prisma.InputJsonValue;
+  }
+}