fix(api): wrap audit log writes inside their parent transactions

Prevents mutations from committing without an audit trail if the
auditLog.create call fails after the main write already succeeded.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/api/src/router/estimate-commercial.ts

@@ -65,22 +65,24 @@ export const estimateCommercialProcedures = {
 
       const validated = CommercialTermsSchema.parse(input.terms);
 
-      await ctx.db.estimateVersion.update({
-        where: { id: version.id },
-        data: { commercialTerms: validated as unknown as Prisma.InputJsonValue },
-      });
+      await ctx.db.$transaction(async (tx) => {
+        await tx.estimateVersion.update({
+          where: { id: version.id },
+          data: { commercialTerms: validated as unknown as Prisma.InputJsonValue },
+        });
 
-      await ctx.db.auditLog.create({
-        data: {
-          entityType: "Estimate",
-          entityId: estimate.id,
-          action: "UPDATE",
-          ...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
-          changes: {
-            field: "commercialTerms",
-            after: validated,
-          } as Prisma.InputJsonValue,
-        },
+        await tx.auditLog.create({
+          data: {
+            entityType: "Estimate",
+            entityId: estimate.id,
+            action: "UPDATE",
+            ...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
+            changes: {
+              field: "commercialTerms",
+              after: validated,
+            } as Prisma.InputJsonValue,
+          },
+        });
       });
 
       return { versionId: version.id, terms: validated };