feat(audit): wider coverage — sensitive views, cron, jobs, portal abuse

Builds on the audit infra split (severity/source) by emitting events
from every place a security or operations review would want to see:

Sensitive data views (severity=warning):
- GDPR export download URL issued
- Audit log page opened (watch-the-watchers; first page only)
- CSV export of expenses
- Webhook secret regenerated

Authentication abuse (severity=warning, source=auth):
- Portal sign-in: success + failed-credentials + portal-disabled
- Portal password reset: unknown email + portal-disabled + bad token
- Portal activation: bad/expired token

Inbound webhook hardening:
- Documenso webhook with invalid X-Documenso-Secret now writes
  webhook_failed instead of being silently logged

Background work (source=cron / job):
- New attachWorkerAudit() helper wires every BullMQ worker to emit
  job_failed (severity=error) on .on('failed') and cron_run on
  .on('completed') for any job whose name matches the recurring
  scheduler list. Applied across all 10 workers.

1175/1175 vitest passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/webhooks/documenso/route.ts

@@ -13,6 +13,7 @@ import {
   handleDocumentCancelled,
 } from '@/lib/services/documents.service';
 import { logger } from '@/lib/logger';
+import { createAuditLog } from '@/lib/audit';
 
 // BR-024: Dedup via signatureHash unique index on documentEvents
 // Always return 200 from webhook (webhook best practice)
@@ -66,6 +67,21 @@ export async function POST(req: NextRequest): Promise<NextResponse> {
   }
   if (!matched) {
     logger.warn({ providedLen: providedSecret.length }, 'Invalid Documenso webhook secret');
+    void createAuditLog({
+      userId: null,
+      portId: null,
+      action: 'webhook_failed',
+      entityType: 'webhook_inbound',
+      entityId: 'documenso',
+      metadata: {
+        reason: 'invalid_secret',
+        providedLen: providedSecret.length,
+      },
+      ipAddress: req.headers.get('x-forwarded-for')?.split(',')[0]?.trim() ?? '',
+      userAgent: req.headers.get('user-agent') ?? '',
+      severity: 'warning',
+      source: 'webhook',
+    });
     return NextResponse.json({ ok: false, error: 'Invalid secret' }, { status: 200 });
   }