Keep an audit log of who did what, and how they came in

Written from model events, spatie's role events and panel sign-ins, only for
what a person did, with secrets masked; pruned after a year.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/audit.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Retention
+    |--------------------------------------------------------------------------
+    |
+    | Days an entry is kept. It names people and the addresses they worked
+    | from, so it is not kept forever; `php artisan model:prune` removes what
+    | is older, and the schedule runs it daily.
+    |
+    */
+
+    'retention_days' => (int) env('AUDIT_RETENTION_DAYS', 365),
+
+];

config/permission.php

@@ -126,7 +126,8 @@ return [
      *
      * To enable, set to true, and then create listeners to watch these events.
      */
-    'events_enabled' => false,
+    // On: role changes are written to the audit log (AppServiceProvider).
+    'events_enabled' => true,
 
     /*
      * Teams Feature.