feat(p9): iios_audit_link table + audit binding at decision points

Task O.3: IiosAuditLink (traceId/correlationId/scopeId/actorRefId/action/
resourceType/resourceId) + recordAudit() helper (reads the current trace from ALS,
best-effort). Written at the decision/mutation points — route approve/deny, AI
accept/reject, meeting summarize, outbound send — so the trace appears in DB and a
decision can be replayed / traced across services (mandated iios_audit_link).
Migration audit-link; resetDb truncates it. 2 tests bind approve/accept to a trace.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/ai/ai.service.ts

@@ -9,6 +9,7 @@ import {
   InferenceResult,
 } from '@insignia/iios-contracts';
 import { currentTraceId, newTraceId, toTraceparent } from '../observability/trace-context';
+import { recordAudit } from '../observability/audit';
 import { PrismaService } from '../prisma/prisma.service';
 import { PLATFORM_PORTS } from '../platform/platform-ports';
 import { decideOrThrow } from '../platform/fail-closed';
@@ -206,6 +207,7 @@ export class AiJobService {
       data: { validationStatus: 'ACCEPTED', acceptedByRef: actor.id },
     });
     await this.emit(IIOS_EVENTS.aiArtifactAccepted, artifact.job.scopeId, artifactId, { artifactId, acceptedByActorId: actor.id });
+    await recordAudit(this.prisma, { action: 'ai.artifact.accepted', resourceType: 'ai_artifact', resourceId: artifactId, scopeId: artifact.job.scopeId, actorRefId: actor.id });
     return updated;
   }
 
@@ -219,6 +221,7 @@ export class AiJobService {
       data: { status: 'REJECTED', acceptedByActorId: actor.id },
     });
     await this.prisma.iiosAiClaim.updateMany({ where: { artifactId }, data: { validationStatus: 'REJECTED', acceptedByRef: actor.id } });
+    await recordAudit(this.prisma, { action: 'ai.artifact.rejected', resourceType: 'ai_artifact', resourceId: artifactId, scopeId: artifact.job.scopeId, actorRefId: actor.id });
     return updated;
   }