Keep an audit log of who did what, and how they came in

Written from model events, spatie's role events and panel sign-ins, only for
what a person did, with secrets masked; pruned after a year.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/permission.php

@@ -126,7 +126,8 @@ return [
      *
      * To enable, set to true, and then create listeners to watch these events.
      */
-    'events_enabled' => false,
+    // On: role changes are written to the audit log (AppServiceProvider).
+    'events_enabled' => true,
 
     /*
      * Teams Feature.