feat: Activity History system — full audit coverage, UI, AI tools

Infrastructure (Phase 1):
- AuditLog schema: add source, entityName, summary fields + index
- createAuditEntry() helper: auto-diff, auto-summary, fire-and-forget
- auditLog query router: list, getByEntity, getTimeline, getActivitySummary

Audit Coverage (Phase 2 — 14 routers, 50+ mutations):
- vacation: create, approve, reject, cancel, batch ops (8 mutations)
- user: create, updateRole, setPermissions, resetPermissions (5 mutations)
- entitlement: set, bulkSet (3 mutations)
- client: create, update, delete, batchUpdateSortOrder
- org-unit: create, update, deactivate
- country: create, update, createCity, updateCity, deleteCity
- management-level: createGroup, updateGroup, createLevel, updateLevel, deleteLevel
- settings: updateSystemSettings (sensitive fields sanitized), testSmtp
- blueprint: create, update, updateRolePresets, delete, batchDelete, setGlobal
- rate-card: create, update, deactivate, addLine, updateLine, deleteLine, replaceLines
- calculation-rules: create, update, delete
- effort-rule: create, update, delete
- experience-multiplier: create, update, delete
- utilization-category: create, update

Admin UI (Phase 3):
- /admin/activity-log page with global searchable timeline
- Filters: entity type, action, user, date range, text search
- Expandable before/after diff view per entry
- Summary cards showing top entity types by change count
- EntityHistory reusable component for entity detail pages
- Sidebar nav link with clock icon

AI Assistant (Phase 4):
- query_change_history tool: "Who changed project X?"
- get_entity_timeline tool: "What happened to resource Y?"

Regression: 283 engine + 37 staffing tests pass. TypeScript clean.

Co-Authored-By: claude-flow <ruv@ruv.net>

packages/api/src/router/user.ts

@@ -13,6 +13,7 @@ import { TRPCError } from "@trpc/server";
 import { z } from "zod";
 import { findUniqueOrThrow } from "../db/helpers.js";
 import { adminProcedure, createTRPCRouter, managerProcedure, protectedProcedure } from "../trpc.js";
+import { createAuditEntry } from "../lib/audit.js";
 
 export const userRouter = createTRPCRouter({
   /** Lightweight user list for task assignment (ADMIN + MANAGER) */
@@ -111,6 +112,17 @@ export const userRouter = createTRPCRouter({
         });
       }
 
+      void createAuditEntry({
+        db: ctx.db,
+        entityType: "User",
+        entityId: user.id,
+        entityName: `${user.name} (${user.email})`,
+        action: "CREATE",
+        ...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
+        after: user as unknown as Record<string, unknown>,
+        source: "ui",
+      });
+
       return user;
     }),
 
@@ -122,11 +134,31 @@ export const userRouter = createTRPCRouter({
       }),
     )
     .mutation(async ({ ctx, input }) => {
-      return ctx.db.user.update({
+      const before = await ctx.db.user.findUniqueOrThrow({
+        where: { id: input.id },
+        select: { id: true, name: true, email: true, systemRole: true },
+      });
+
+      const updated = await ctx.db.user.update({
         where: { id: input.id },
         data: { systemRole: input.systemRole },
         select: { id: true, name: true, email: true, systemRole: true },
       });
+
+      void createAuditEntry({
+        db: ctx.db,
+        entityType: "User",
+        entityId: updated.id,
+        entityName: `${updated.name} (${updated.email})`,
+        action: "UPDATE",
+        ...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
+        before: before as unknown as Record<string, unknown>,
+        after: updated as unknown as Record<string, unknown>,
+        source: "ui",
+        summary: `Changed role from ${before.systemRole} to ${updated.systemRole}`,
+      });
+
+      return updated;
     }),
 
   // ─── Resource Linking ──────────────────────────────────────────────────
@@ -242,20 +274,61 @@ export const userRouter = createTRPCRouter({
       }),
     )
     .mutation(async ({ ctx, input }) => {
+      const before = await ctx.db.user.findUniqueOrThrow({
+        where: { id: input.userId },
+        select: { id: true, name: true, email: true, permissionOverrides: true },
+      });
+
       const user = await ctx.db.user.update({
         where: { id: input.userId },
         data: { permissionOverrides: input.overrides ?? Prisma.DbNull },
       });
+
+      void createAuditEntry({
+        db: ctx.db,
+        entityType: "User",
+        entityId: input.userId,
+        entityName: `${before.name} (${before.email})`,
+        action: "UPDATE",
+        ...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
+        before: { permissionOverrides: before.permissionOverrides } as unknown as Record<string, unknown>,
+        after: { permissionOverrides: input.overrides } as unknown as Record<string, unknown>,
+        source: "ui",
+        summary: input.overrides
+          ? `Set permission overrides (granted: ${input.overrides.granted?.length ?? 0}, denied: ${input.overrides.denied?.length ?? 0})`
+          : "Cleared permission overrides",
+      });
+
       return user;
     }),
 
   resetPermissions: adminProcedure
     .input(z.object({ userId: z.string() }))
     .mutation(async ({ ctx, input }) => {
-      return ctx.db.user.update({
+      const before = await ctx.db.user.findUniqueOrThrow({
+        where: { id: input.userId },
+        select: { id: true, name: true, email: true, permissionOverrides: true },
+      });
+
+      const updated = await ctx.db.user.update({
         where: { id: input.userId },
         data: { permissionOverrides: Prisma.DbNull },
       });
+
+      void createAuditEntry({
+        db: ctx.db,
+        entityType: "User",
+        entityId: input.userId,
+        entityName: `${before.name} (${before.email})`,
+        action: "UPDATE",
+        ...(ctx.dbUser?.id ? { userId: ctx.dbUser.id } : {}),
+        before: { permissionOverrides: before.permissionOverrides } as unknown as Record<string, unknown>,
+        after: { permissionOverrides: null } as unknown as Record<string, unknown>,
+        source: "ui",
+        summary: "Reset permission overrides to role defaults",
+      });
+
+      return updated;
     }),
 
   getColumnPreferences: protectedProcedure.query(async ({ ctx }) => {