Keep an audit log of who did what, and how they came in

Written from model events, spatie's role events and panel sign-ins, only for
what a person did, with secrets masked; pruned after a year.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/audit.php

@@ -0,0 +1,20 @@
+<?php
+
+declare(strict_types=1);
+
+return [
+
+    /*
+    |--------------------------------------------------------------------------
+    | Retention
+    |--------------------------------------------------------------------------
+    |
+    | Days an entry is kept. It names people and the addresses they worked
+    | from, so it is not kept forever; `php artisan model:prune` removes what
+    | is older, and the schedule runs it daily.
+    |
+    */
+
+    'retention_days' => (int) env('AUDIT_RETENTION_DAYS', 365),
+
+];