feat(audit): wider coverage — sensitive views, cron, jobs, portal abuse

Builds on the audit infra split (severity/source) by emitting events
from every place a security or operations review would want to see:

Sensitive data views (severity=warning):
- GDPR export download URL issued
- Audit log page opened (watch-the-watchers; first page only)
- CSV export of expenses
- Webhook secret regenerated

Authentication abuse (severity=warning, source=auth):
- Portal sign-in: success + failed-credentials + portal-disabled
- Portal password reset: unknown email + portal-disabled + bad token
- Portal activation: bad/expired token

Inbound webhook hardening:
- Documenso webhook with invalid X-Documenso-Secret now writes
  webhook_failed instead of being silently logged

Background work (source=cron / job):
- New attachWorkerAudit() helper wires every BullMQ worker to emit
  job_failed (severity=error) on .on('failed') and cron_run on
  .on('completed') for any job whose name matches the recurring
  scheduler list. Applied across all 10 workers.

1175/1175 vitest passing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/queue/workers/ai.ts

@@ -3,6 +3,7 @@ import { env } from '@/lib/env';
 
 import type { ConnectionOptions } from 'bullmq';
 import { logger } from '@/lib/logger';
+import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
 import { QUEUE_CONFIGS } from '@/lib/queue';
 
 // ─── Email draft generation ───────────────────────────────────────────────────
@@ -319,3 +320,5 @@ export const aiWorker = new Worker(
 aiWorker.on('failed', (job, err) => {
   logger.error({ jobId: job?.id, jobName: job?.name, err }, 'AI job failed');
 });
+
+attachWorkerAudit(aiWorker, 'ai');

src/lib/queue/workers/bulk.ts

@@ -3,6 +3,7 @@ import { env } from '@/lib/env';
 
 import type { ConnectionOptions } from 'bullmq';
 import { logger } from '@/lib/logger';
+import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
 import { QUEUE_CONFIGS } from '@/lib/queue';
 
 /**
@@ -30,3 +31,5 @@ export const bulkWorker = new Worker(
 bulkWorker.on('failed', (job, err) => {
   logger.error({ jobId: job?.id, jobName: job?.name, err }, 'Bulk job failed');
 });
+
+attachWorkerAudit(bulkWorker, 'bulk');

src/lib/queue/workers/documents.ts

@@ -3,6 +3,7 @@ import { env } from '@/lib/env';
 
 import type { ConnectionOptions } from 'bullmq';
 import { logger } from '@/lib/logger';
+import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
 import { QUEUE_CONFIGS } from '@/lib/queue';
 
 export const documentsWorker = new Worker(
@@ -48,3 +49,5 @@ export const documentsWorker = new Worker(
 documentsWorker.on('failed', (job, err) => {
   logger.error({ jobId: job?.id, jobName: job?.name, err }, 'Documents job failed');
 });
+
+attachWorkerAudit(documentsWorker, 'documents');

src/lib/queue/workers/email.ts

@@ -3,6 +3,7 @@ import { env } from '@/lib/env';
 
 import type { ConnectionOptions } from 'bullmq';
 import { logger } from '@/lib/logger';
+import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
 import { QUEUE_CONFIGS } from '@/lib/queue';
 
 export const emailWorker = new Worker(
@@ -65,3 +66,5 @@ export const emailWorker = new Worker(
 emailWorker.on('failed', (job, err) => {
   logger.error({ jobId: job?.id, jobName: job?.name, err }, 'Email job failed');
 });
+
+attachWorkerAudit(emailWorker, 'email');

src/lib/queue/workers/export.ts

@@ -3,6 +3,7 @@ import { env } from '@/lib/env';
 
 import type { ConnectionOptions } from 'bullmq';
 import { logger } from '@/lib/logger';
+import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
 import { QUEUE_CONFIGS } from '@/lib/queue';
 
 export const exportWorker = new Worker(
@@ -35,3 +36,5 @@ export const exportWorker = new Worker(
 exportWorker.on('failed', (job, err) => {
   logger.error({ jobId: job?.id, jobName: job?.name, err }, 'Export job failed');
 });
+
+attachWorkerAudit(exportWorker, 'export');

src/lib/queue/workers/import.ts

@@ -3,6 +3,7 @@ import { env } from '@/lib/env';
 
 import type { ConnectionOptions } from 'bullmq';
 import { logger } from '@/lib/logger';
+import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
 import { QUEUE_CONFIGS } from '@/lib/queue';
 
 export const importWorker = new Worker(
@@ -23,3 +24,5 @@ export const importWorker = new Worker(
 importWorker.on('failed', (job, err) => {
   logger.error({ jobId: job?.id, jobName: job?.name, err }, 'Import job failed');
 });
+
+attachWorkerAudit(importWorker, 'import');

src/lib/queue/workers/maintenance.ts

@@ -10,6 +10,7 @@ import { aiUsageLedger } from '@/lib/db/schema/ai-usage';
 import { errorEvents } from '@/lib/db/schema/system';
 import { websiteSubmissions } from '@/lib/db/schema/website-submissions';
 import { logger } from '@/lib/logger';
+import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
 import { getStorageBackend } from '@/lib/storage';
 import { QUEUE_CONFIGS } from '@/lib/queue';
 
@@ -168,3 +169,5 @@ export const maintenanceWorker = new Worker(
 maintenanceWorker.on('failed', (job, err) => {
   logger.error({ jobId: job?.id, jobName: job?.name, err }, 'Maintenance job failed');
 });
+
+attachWorkerAudit(maintenanceWorker, 'maintenance');

src/lib/queue/workers/notifications.ts

@@ -3,6 +3,7 @@ import { env } from '@/lib/env';
 
 import type { ConnectionOptions } from 'bullmq';
 import { logger } from '@/lib/logger';
+import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
 import { QUEUE_CONFIGS } from '@/lib/queue';
 
 export const notificationsWorker = new Worker(
@@ -88,3 +89,5 @@ export const notificationsWorker = new Worker(
 notificationsWorker.on('failed', (job, err) => {
   logger.error({ jobId: job?.id, jobName: job?.name, err }, 'Notifications job failed');
 });
+
+attachWorkerAudit(notificationsWorker, 'notifications');

src/lib/queue/workers/reports.ts

@@ -3,6 +3,7 @@ import { env } from '@/lib/env';
 
 import type { ConnectionOptions } from 'bullmq';
 import { logger } from '@/lib/logger';
+import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
 import { QUEUE_CONFIGS } from '@/lib/queue';
 
 export const reportsWorker = new Worker(
@@ -70,3 +71,5 @@ export const reportsWorker = new Worker(
 reportsWorker.on('failed', (job, err) => {
   logger.error({ jobId: job?.id, jobName: job?.name, err }, 'Reports job failed');
 });
+
+attachWorkerAudit(reportsWorker, 'reports');

src/lib/queue/workers/webhooks.ts

@@ -5,6 +5,7 @@ import { lookup } from 'node:dns/promises';
 
 import type { ConnectionOptions } from 'bullmq';
 import { logger } from '@/lib/logger';
+import { attachWorkerAudit } from '@/lib/queue/audit-helpers';
 import { QUEUE_CONFIGS } from '@/lib/queue';
 import { isLocalOrPrivateHost } from '@/lib/validators/webhooks';
 
@@ -321,3 +322,5 @@ export const webhooksWorker = new Worker(
 webhooksWorker.on('failed', (job, err) => {
   logger.error({ jobId: job?.id, jobName: job?.name, err }, 'Webhooks job failed');
 });
+
+attachWorkerAudit(webhooksWorker, 'webhooks');