fix(api): wrap audit log writes inside their parent transactions

Prevents mutations from committing without an audit trail if the
auditLog.create call fails after the main write already succeeded.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/api/src/__tests__/import-export-router.test.ts

@@ -73,17 +73,19 @@ describe("import-export router", () => {
     });
     const resourceUpdate = vi.fn().mockResolvedValue({ id: "res_1" });
     const auditCreate = vi.fn().mockResolvedValue({ id: "audit_1" });
+    const importDb: Record<string, unknown> = {
+      resource: {
+        findFirst: resourceFindFirst,
+        update: resourceUpdate,
+      },
+      auditLog: {
+        create: auditCreate,
+      },
+    };
+    importDb["$transaction"] = vi.fn(async (fn: (tx: unknown) => unknown) => fn(importDb));
 
     const caller = createProtectedCaller(
-      {
-        resource: {
-          findFirst: resourceFindFirst,
-          update: resourceUpdate,
-        },
-        auditLog: {
-          create: auditCreate,
-        },
-      },
+      importDb,
       {
         role: SystemRole.MANAGER,
         granted: [PermissionKey.IMPORT_DATA],