Add structured audit logging for admin mutation routes

[owens1127]

Summary

• Introduces a reusable audit logging primitive (writeAuditLog, auditRoute, sanitizeForAudit) that emits structured ADMIN_ACTION logs via the AUDIT logger
• Adds optional audit config to RaidHubRoute so important routes opt in without handler changes
• Wires audit logging to admin mutations: blacklist updates, player cheat-level patches, and admin SQL queries

Each log includes actor Bungie membership ID, route, outcome, sanitized request params/body, and selected response fields — so manual UI blacklists (e.g. from PGCR menu) are traceable in Loki/Grafana even though Postgres only stores the blacklist row itself.

Test plan

• bun test src/middleware/audit-log.test.ts
• bun typecheck, bun lint, bun format --check locally
• CI: Static PR Checks (tsc, lint, format, openapi verify)
• CI: Tests + coverage

Made with Cursor

[barecheck]

Barecheck - Code coverage report

Total: 91.4%

Your code coverage diff: 0.48% ▴

Uncovered files and lines

File	Lines
src/core/RaidHubRoute.ts	284
src/routes/admin/query.ts	94-99, 113
src/routes/admin/reporting/blacklist.ts	57-95
src/routes/admin/reporting/player.ts	37-55