feat: AI security controls + PostgreSQL hardening (Week 1 Quick Wins)

AI Security (EGAI 4.3.1.3, 4.3.1.4, 4.1.3.1, IAAI 3.6.26):
- AI Disclaimer banner in ChatPanel: "AI responses may be inaccurate"
- "AI Generated" violet badge on: chat messages, AI summaries,
  project narratives, AI-generated cover images
- HITL: system prompt now requires explicit user confirmation
  before any data mutation (strongly worded instruction)
- Mutation tool audit logging: all 31 write tools logged with
  tool name, params, userId, userRole via Pino

PostgreSQL Hardening (PG Standard V1.6):
- Audit logging: log_connections, log_disconnections, log_statement=ddl,
  log_min_duration_statement=1000 in docker-compose
- SUPERUSER removal script: scripts/harden-postgres.sh
  (NOSUPERUSER + minimal GRANT for app user)
- Health check: pg_isready -U capakraken -d capakraken
- Documentation: security-architecture.md Section 12 updated

Controls closed: EGAI 4.1.3.1, 4.3.1.3, 4.3.1.4, PG 3.3, 3.5

Co-Authored-By: claude-flow <ruv@ruv.net>

packages/api/src/router/assistant-tools.ts

@@ -19,6 +19,24 @@ import {
   emitTaskStatusChanged,
   emitBroadcastSent,
 } from "../sse/event-bus.js";
+import { logger } from "../lib/logger.js";
+
+// ─── Mutation tool set for audit logging (EGAI 4.1.3.1 / IAAI 3.6.26) ──────
+
+const MUTATION_TOOLS = new Set([
+  "create_allocation", "cancel_allocation", "update_allocation_status",
+  "update_resource", "deactivate_resource", "create_resource",
+  "update_project", "create_project", "delete_project",
+  "create_vacation", "approve_vacation", "reject_vacation", "cancel_vacation",
+  "set_entitlement", "create_demand", "fill_demand",
+  "generate_project_cover", "remove_project_cover",
+  "create_role", "update_role", "delete_role",
+  "create_client", "update_client",
+  "create_org_unit", "update_org_unit",
+  "send_broadcast", "create_task_for_user", "create_reminder",
+  "update_task_status", "execute_task_action",
+  "create_comment", "resolve_comment",
+]);
 
 // ─── Types ──────────────────────────────────────────────────────────────────
 
@@ -5613,6 +5631,15 @@ export async function executeTool(
 
   try {
     const params = JSON.parse(args);
+
+    // Audit-log all mutation tool executions (EGAI 4.1.3.1 / IAAI 3.6.26)
+    if (MUTATION_TOOLS.has(name)) {
+      logger.info(
+        { tool: name, params, userId: ctx.userId, userRole: ctx.userRole },
+        "AI assistant mutation tool executed",
+      );
+    }
+
     const result = await executor(params, ctx);
 
     // Detect action payloads (e.g. navigation, invalidation)