feat(audit): wider coverage — sensitive views, cron, jobs, portal abuse

Builds on the audit infra split (severity/source) by emitting events
from every place a security or operations review would want to see:

Sensitive data views (severity=warning):
- GDPR export download URL issued
- Audit log page opened (watch-the-watchers; first page only)
- CSV export of expenses
- Webhook secret regenerated

Authentication abuse (severity=warning, source=auth):
- Portal sign-in: success + failed-credentials + portal-disabled
- Portal password reset: unknown email + portal-disabled + bad token
- Portal activation: bad/expired token

Inbound webhook hardening:
- Documenso webhook with invalid X-Documenso-Secret now writes
  webhook_failed instead of being silently logged

Background work (source=cron / job):
- New attachWorkerAudit() helper wires every BullMQ worker to emit
  job_failed (severity=error) on .on('failed') and cron_run on
  .on('completed') for any job whose name matches the recurring
  scheduler list. Applied across all 10 workers.

1175/1175 vitest passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/v1/expenses/export/csv/route.ts

@@ -4,6 +4,7 @@ import { withAuth, withPermission } from '@/lib/api/helpers';
 import { errorResponse } from '@/lib/errors';
 import { exportCsv } from '@/lib/services/expense-export';
 import { listExpensesSchema } from '@/lib/validators/expenses';
+import { createAuditLog } from '@/lib/audit';
 
 export const POST = withAuth(
   withPermission('expenses', 'view', async (req, ctx) => {
@@ -12,6 +13,18 @@ export const POST = withAuth(
       const query = listExpensesSchema.parse(body);
       const csv = await exportCsv(ctx.portId, query);
 
+      void createAuditLog({
+        userId: ctx.userId,
+        portId: ctx.portId,
+        action: 'send',
+        entityType: 'expense_export',
+        entityId: 'csv',
+        metadata: { format: 'csv', filterCount: Object.keys(query).length, byteSize: csv.length },
+        ipAddress: ctx.ipAddress,
+        userAgent: ctx.userAgent,
+        severity: 'warning',
+      });
+
       return new NextResponse(csv, {
         status: 200,
         headers: {