Keep an audit log of who did what, and how they came in

Written from model events, spatie's role events and panel sign-ins, only for
what a person did, with secrets masked; pruned after a year.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

database/migrations/2026_10_01_110000_create_audit_logs_table.php

@@ -0,0 +1,49 @@
+<?php
+
+declare(strict_types=1);
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+/**
+ * Who did what, when, and by which way in — the panel, the API, a machine
+ * token. The history of each record answers "what happened to this"; this
+ * answers "what has this person been doing", across everything, including
+ * what has no history of its own: roles, settings, tokens, webhooks.
+ */
+return new class extends Migration
+{
+    public function up(): void
+    {
+        Schema::create('audit_logs', function (Blueprint $table): void {
+            $table->id();
+            $table->foreignId('user_id')->nullable()->constrained()->nullOnDelete();
+
+            // Kept beside the id: accounts get deleted, and an audit log that
+            // forgets who did something is not one.
+            $table->string('user_name')->nullable();
+
+            $table->string('via', 10);
+            $table->foreignId('api_token_id')->nullable()->constrained()->nullOnDelete();
+            $table->string('ip', 45)->nullable();
+
+            $table->string('action', 80);
+            $table->string('subject_type', 40)->nullable();
+            $table->string('subject_id', 64)->nullable();
+            $table->string('subject_label')->nullable();
+            $table->jsonb('changes')->nullable();
+
+            $table->timestamp('created_at')->useCurrent();
+
+            $table->index(['user_id', 'created_at']);
+            $table->index(['subject_type', 'subject_id']);
+            $table->index('created_at');
+        });
+    }
+
+    public function down(): void
+    {
+        Schema::dropIfExists('audit_logs');
+    }
+};