feat(p9): iios_audit_link table + audit binding at decision points

Task O.3: IiosAuditLink (traceId/correlationId/scopeId/actorRefId/action/
resourceType/resourceId) + recordAudit() helper (reads the current trace from ALS,
best-effort). Written at the decision/mutation points — route approve/deny, AI
accept/reject, meeting summarize, outbound send — so the trace appears in DB and a
decision can be replayed / traced across services (mandated iios_audit_link).
Migration audit-link; resetDb truncates it. 2 tests bind approve/accept to a trace.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/iios-service/src/routing/route.service.ts

@@ -2,6 +2,7 @@ import { BadRequestException, Injectable, NotFoundException } from '@nestjs/comm
 import { Prisma, IiosRouteBinding, IiosRouteDecision, IiosRouteMode, IiosOutputFormat } from '@prisma/client';
 import { CloudEvent, IIOS_EVENTS } from '@insignia/iios-contracts';
 import { currentTraceId, newTraceId, toTraceparent } from '../observability/trace-context';
+import { recordAudit } from '../observability/audit';
 import { PrismaService } from '../prisma/prisma.service';
 import { RouteSimulator, type OriginRef } from './route-simulator';
 import { OutboundService } from '../adapters/outbound.service';
@@ -71,6 +72,7 @@ export class RouteService {
       data: { decisionState: 'ALLOW', decidedByActorId: actor.id },
     });
     await this.emitApproved(decision.routeBinding.scopeId, decisionId);
+    await recordAudit(this.prisma, { action: 'route.decision.approved', resourceType: 'route_decision', resourceId: decisionId, scopeId: decision.routeBinding.scopeId, actorRefId: actor.id });
     await this.execute(updated, decision.routeBinding);
     return this.prisma.iiosRouteDecision.findUniqueOrThrow({ where: { id: decisionId } });
   }
@@ -80,10 +82,12 @@ export class RouteService {
     if (!decision) throw new NotFoundException('route decision not found');
     await this.actors.assertOwns(principal, decision.routeBinding.scopeId); // tenant fence (KG-02)
     const actor = await this.actors.resolveActor(decision.routeBinding.scopeId, principal);
-    return this.prisma.iiosRouteDecision.update({
+    const updated = await this.prisma.iiosRouteDecision.update({
       where: { id: decisionId },
       data: { decisionState: 'DENY', decidedByActorId: actor.id },
     });
+    await recordAudit(this.prisma, { action: 'route.decision.denied', resourceType: 'route_decision', resourceId: decisionId, scopeId: decision.routeBinding.scopeId, actorRefId: actor.id });
+    return updated;
   }
 
   /** Dispatch an ALLOW decision to the P5 sandbox (no real network). Idempotent. */