feat: add audit log tables, indexes, and CLI/content recording hooks

devplacepy/routers/devii.py

@@ -18,6 +18,7 @@ from devplacepy.utils import (
     get_current_user,
     is_admin,
 )
+from devplacepy.services.audit import record as audit
 
 logger = logging.getLogger("devii.router")
 
@@ -173,6 +174,12 @@ async def clippy_proxy(request: Request):
         headers["Authorization"] = f"Bearer {cfg['devii_ai_key']}"
     async with httpx.AsyncClient(timeout=45.0) as client:
         upstream = await client.post(cfg["devii_ai_url"], content=body, headers=headers)
+    audit.record(
+        request,
+        "ai.clippy.chat",
+        summary="clippy AI chat",
+        metadata={"status_code": upstream.status_code},
+    )
     return JSONResponse(
         content=upstream.json()
         if upstream.headers.get("content-type", "").startswith("application/json")
@@ -229,6 +236,18 @@ async def devii_ws(websocket: WebSocket):
                 limit = svc.daily_limit_for(owner_kind, owner_is_admin)
                 spent = svc.spent_24h(owner_kind, owner_id)
                 if limit > 0 and spent >= limit:
+                    audit.record_system(
+                        "ai.quota.exceeded",
+                        actor_kind=owner_kind if owner_kind == "guest" else "user",
+                        actor_uid=owner_id if owner_kind == "user" else None,
+                        actor_username=username,
+                        actor_role="admin" if owner_is_admin else ("guest" if owner_kind == "guest" else "member"),
+                        origin="devii",
+                        via_agent=1,
+                        result="denied",
+                        summary=f"AI request by {username or owner_id} blocked - 24h quota reached",
+                        metadata={"limit_usd": limit, "owner_kind": owner_kind},
+                    )
                     await websocket.send_json(
                         {
                             "type": "error",