Add comprehensive ISAC audit logging

AGENTS.md

@@ -49,6 +49,46 @@ All ISAC data-management editors must follow the same successful-save behavior:
 
 Apply this convention whenever an ISAC editor is added or materially changed.
 
+## ISAC audit logging
+
+Every successful server-side mutation performed through ISAC must create an
+append-only audit event. Audit coverage is a required part of implementing or
+changing any ISAC module, action, endpoint, bulk operation, moderation control,
+identity operation, access-policy change, archive action, or destructive action.
+
+Follow these rules:
+
+1. Use the shared audit utilities in `src/lib/server/audit.ts`; do not invent
+   module-specific audit formats or write directly to `audit_log` in new code.
+2. Record the authenticated operator ID, stable category, specific action,
+   target entity ID, timestamp, and useful before/after snapshots.
+3. Categories describe durable operational domains such as `game_data`,
+   `user_access`, `user_moderation`, `identity`, and `role_management`.
+   Actions describe the exact event in namespaced past tense, such as
+   `weapon.updated`, `attribute.archived`, or `moderation.blocked`.
+4. Capture relationship changes as well as the primary row. When an action
+   replaces permission sets, compatible brands, talents, effects, tiers, or
+   other linked records, include the meaningful previous and resulting sets.
+5. Create audit records only after validation succeeds and the requested
+   mutation has completed. Rejected, unauthorized, or validation-failed
+   requests must not appear as successful mutation events.
+6. Never include password hashes, session tokens, magic-link tokens, OAuth
+   state, passkey public-key bytes, SMTP credentials, environment secrets, or
+   other authentication secrets in audit snapshots. Minimize personal data to
+   what is necessary for security, support, and accountability.
+7. Audit visibility is controlled by `audit.view`. The read-only `Auditor` role
+   grants `isac.access` and `audit.view`; it must not implicitly grant mutation,
+   moderation, identity-management, or user-access permissions.
+8. New audit categories and actions must remain searchable in the Audit History
+   registry. Update its grouped filters when a new durable operational domain is
+   introduced.
+9. Preserve audit history during normal record archival and soft deletion.
+   Never add an ISAC action that edits or deletes audit records without an
+   explicit retention policy, legal review, and separately audited authority.
+10. Tests and handoff verification for an ISAC mutation must include confirming
+    that its audit event contains the correct actor, category, action, target,
+    and change evidence.
+
 ## Database preservation
 
 Development data is valuable and may be entered by non-technical contributors.