feat(audit): add comprehensive audit logging with SIEM integration

- Add AuditLog model with append-only design (timestamp, user, action, resource, IP, details, severity)
- Add audit_service.py with record/query helpers and SIEM forwarding (Syslog RFC 5424, HTTP/webhook)
- Add /api/audit-logs REST endpoints with filtering and pagination
- Add /admin/audit-logs viewer UI with real-time filters
- Add SIEM config settings (syslog, HTTP for Splunk HEC/Logstash/Grafana Loki)
- Add Alembic migration 027_add_audit_logs
- Add navigation link in admin menu
- Add comprehensive tests (20 tests covering model, service, SIEM, API, view)

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

app/views/__init__.py

@@ -6,6 +6,7 @@ from fastapi import APIRouter
 
 from app.views.admin_users import router as admin_users_router
 from app.views.api_tokens import router as api_tokens_router
+from app.views.audit_logs import router as audit_logs_router
 from app.views.backup import router as backup_router
 from app.views.db_wizard import router as db_wizard_router
 from app.views.dropbox import router as dropbox_router
@@ -60,4 +61,5 @@ router.include_router(imap_accounts_router)  # Per-user IMAP ingestion accounts
 router.include_router(integrations_router)  # Unified integrations dashboard
 router.include_router(notifications_router)  # User notification dashboard
 router.include_router(scheduled_jobs_router)  # Admin scheduled batch jobs
+router.include_router(audit_logs_router)  # Comprehensive audit log viewer
 router.include_router(help_router)  # Built-in help / How-To docs

app/views/audit_logs.py

@@ -0,0 +1,46 @@
+"""
+Audit log viewer UI — admin-only page with filtering and SIEM status.
+"""
+
+import logging
+
+from fastapi import Depends, HTTPException, Request, status
+from sqlalchemy.orm import Session
+
+from app.views.base import APIRouter, get_db, require_login, settings, templates
+from app.views.settings import require_admin_access
+
+logger = logging.getLogger(__name__)
+router = APIRouter()
+
+
+@router.get("/admin/audit-logs")
+@require_login
+@require_admin_access
+async def audit_logs_page(request: Request, db: Session = Depends(get_db)):
+    """Comprehensive audit log viewer with filtering controls.
+
+    Displays a chronological log of all significant actions: logins,
+    document operations, settings changes, and admin actions.  The
+    actual data is fetched client-side via the ``/api/audit-logs`` JSON
+    endpoint so that filters, pagination, and live refresh work without
+    full-page reloads.
+    """
+    try:
+        siem_enabled = settings.audit_siem_enabled
+        siem_transport = settings.audit_siem_transport if siem_enabled else None
+        return templates.TemplateResponse(
+            "audit_logs.html",
+            {
+                "request": request,
+                "app_version": settings.version,
+                "siem_enabled": siem_enabled,
+                "siem_transport": siem_transport,
+            },
+        )
+    except Exception as e:
+        logger.error("Error loading audit logs page: %s", e)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Failed to load audit logs page",
+        )