feat(audit): add comprehensive audit logging with SIEM integration

- Add AuditLog model with append-only design (timestamp, user, action, resource, IP, details, severity)
- Add audit_service.py with record/query helpers and SIEM forwarding (Syslog RFC 5424, HTTP/webhook)
- Add /api/audit-logs REST endpoints with filtering and pagination
- Add /admin/audit-logs viewer UI with real-time filters
- Add SIEM config settings (syslog, HTTP for Splunk HEC/Logstash/Grafana Loki)
- Add Alembic migration 027_add_audit_logs
- Add navigation link in admin menu
- Add comprehensive tests (20 tests covering model, service, SIEM, API, view)

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

migrations/env.py

@@ -21,6 +21,7 @@ from app.database import Base
 # Ensure all models are imported so Base.metadata is populated.
 from app.models import (  # noqa: F401
     ApplicationSettings,
+    AuditLog,
     DocumentMetadata,
     FileProcessingStep,
     FileRecord,

migrations/versions/027_add_audit_logs.py

@@ -0,0 +1,47 @@
+"""Add audit_logs table for comprehensive compliance audit logging.
+
+Revision ID: 027_add_audit_logs
+Revises: 026_add_scheduled_jobs
+Create Date: 2026-03-09
+"""
+
+from typing import Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "027_add_audit_logs"
+down_revision: Union[str, None] = "026_add_scheduled_jobs"
+depends_on: Union[str, None] = None
+
+
+def upgrade() -> None:
+    """Create audit_logs table."""
+    op.create_table(
+        "audit_logs",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("timestamp", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("user", sa.String(), nullable=False),
+        sa.Column("action", sa.String(), nullable=False),
+        sa.Column("resource_type", sa.String(), nullable=True),
+        sa.Column("resource_id", sa.String(), nullable=True),
+        sa.Column("ip_address", sa.String(), nullable=True),
+        sa.Column("details", sa.Text(), nullable=True),
+        sa.Column("severity", sa.String(16), nullable=False, server_default="info"),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index("ix_audit_logs_id", "audit_logs", ["id"])
+    op.create_index("ix_audit_logs_timestamp", "audit_logs", ["timestamp"])
+    op.create_index("ix_audit_logs_user", "audit_logs", ["user"])
+    op.create_index("ix_audit_logs_action", "audit_logs", ["action"])
+    op.create_index("ix_audit_logs_resource_type", "audit_logs", ["resource_type"])
+
+
+def downgrade() -> None:
+    """Drop audit_logs table."""
+    op.drop_index("ix_audit_logs_resource_type", "audit_logs")
+    op.drop_index("ix_audit_logs_action", "audit_logs")
+    op.drop_index("ix_audit_logs_user", "audit_logs")
+    op.drop_index("ix_audit_logs_timestamp", "audit_logs")
+    op.drop_index("ix_audit_logs_id", "audit_logs")
+    op.drop_table("audit_logs")