feat(p9): iios_audit_link table + audit binding at decision points

Task O.3: IiosAuditLink (traceId/correlationId/scopeId/actorRefId/action/
resourceType/resourceId) + recordAudit() helper (reads the current trace from ALS,
best-effort). Written at the decision/mutation points — route approve/deny, AI
accept/reject, meeting summarize, outbound send — so the trace appears in DB and a
decision can be replayed / traced across services (mandated iios_audit_link).
Migration audit-link; resetDb truncates it. 2 tests bind approve/accept to a trace.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/prisma/migrations/20260702193535_audit_link/migration.sql

@@ -0,0 +1,23 @@
+-- CreateTable
+CREATE TABLE "IiosAuditLink" (
+    "id" TEXT NOT NULL,
+    "traceId" TEXT,
+    "correlationId" TEXT,
+    "scopeId" TEXT,
+    "actorRefId" TEXT,
+    "action" TEXT NOT NULL,
+    "resourceType" TEXT NOT NULL,
+    "resourceId" TEXT NOT NULL,
+    "createdAt" TIMESTAMP(3) NOT NULL DEFAULT CURRENT_TIMESTAMP,
+
+    CONSTRAINT "IiosAuditLink_pkey" PRIMARY KEY ("id")
+);
+
+-- CreateIndex
+CREATE INDEX "IiosAuditLink_traceId_idx" ON "IiosAuditLink"("traceId");
+
+-- CreateIndex
+CREATE INDEX "IiosAuditLink_resourceType_resourceId_idx" ON "IiosAuditLink"("resourceType", "resourceId");
+
+-- CreateIndex
+CREATE INDEX "IiosAuditLink_scopeId_idx" ON "IiosAuditLink"("scopeId");

packages/iios-service/prisma/schema.prisma

@@ -1158,3 +1158,23 @@ model IiosCalendarSyncCursor {
 
   @@unique([providerAccountId])
 }
+
+// ─── Observability (P9) ───────────────────────────────────────────
+
+/// Binds an IIOS action to its trace / actor / resource for cross-service causality
+/// and "replay a decision" (mandated iios_audit_link). Written at decision points.
+model IiosAuditLink {
+  id            String   @id @default(cuid())
+  traceId       String?
+  correlationId String?
+  scopeId       String?
+  actorRefId    String?
+  action        String
+  resourceType  String
+  resourceId    String
+  createdAt     DateTime @default(now())
+
+  @@index([traceId])
+  @@index([resourceType, resourceId])
+  @@index([scopeId])
+}