Add structured audit logging for admin mutation routes - #143

Summary

• Introduces a reusable audit logging primitive (writeAuditLog, auditRoute, sanitizeForAudit) that emits structured ADMIN_ACTION logs via the AUDIT logger
• Adds optional audit config to RaidHubRoute so important routes opt in without handler changes
• Wires audit logging to admin mutations: blacklist updates, player cheat-level patches, and admin SQL queries

Each log includes actor Bungie membership ID, route, outcome, sanitized request params/body, and selected response fields — so manual UI blacklists (e.g. from PGCR menu) are traceable in Loki/Grafana even though Postgres only stores the blacklist row itself.

Test plan

• bun test src/middleware/audit-log.test.ts
• bun typecheck, bun lint, bun format --check locally
• CI: Static PR Checks (tsc, lint, format, openapi verify)
• CI: Tests + coverage

Made with Cursor