Add audit log for moderation and admin actions

New audit_log table records actor, action, target and a JSON snapshot
of the details, so entries stay readable after the target is deleted;
the actor is set to NULL when the user is removed. logAudit() is called
from upload delete (single and bulk), comment delete, tag removal, role
create/delete, role permission changes, role assign/revoke and MOTD
updates. Logging failures only warn and never fail the action itself.

The admin page gets an audit card behind the new audit.view permission
with action filter, click-to-filter by user, readable summaries per
action and server-side pagination. Action catalog lives in
shared/utils/audit.ts, labels under admin.auditActions (de/en).

Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/utils/audit.ts

@@ -0,0 +1,24 @@
+import type { AuditAction } from '../../shared/utils/audit'
+import { auditLog } from '../db/schema'
+
+// Fehler beim Protokollieren dürfen die eigentliche Aktion nicht scheitern
+// lassen — die ist zu diesem Zeitpunkt bereits ausgeführt
+export async function logAudit(
+  userId: number,
+  action: AuditAction,
+  target: { type: string, id: string | number } | null,
+  details?: Record<string, unknown>,
+) {
+  try {
+    await useDb().insert(auditLog).values({
+      userId,
+      action,
+      targetType: target?.type ?? null,
+      targetId: target ? String(target.id) : null,
+      details: details ?? null,
+    })
+  }
+  catch (err) {
+    console.warn('[audit] Eintrag fehlgeschlagen:', err instanceof Error ? err.message : err)
+  }
+}