feat: comprehensive audit log

config/services.yaml

@@ -19,6 +19,13 @@ services:
     App\:
         resource: '../src/'
 
+    # The audit trail writes to its own channel, never to the default one: the rotating
+    # audit.*.log is the record of who moved what, and mixing framework noise into it (or the
+    # trail into the framework log) would defeat both.
+    App\Service\AuditLogger:
+        arguments:
+            $logger: '@monolog.logger.audit'
+
     # The myep OAuth2 client. Endpoint URLs are configuration rather than constants (same as
     # myep-team), so dev, staging and production differ by .env alone. Empty credentials are a
     # valid state: the login page then says the client is not registered yet instead of bouncing