Audit-log /api/ai/triage requests

[lai3d]

Summary

Closes the last lower-priority gap from the original AI-features review: triage requests left no record. Now every triage that passes RBAC + rate-limit writes an audit_logs row, queryable via GET /api/audit-logs?resource=ai_triage (admin-only).

Logged shape

Column	Value
action	\"triage\"
resource	\"ai_triage\"
resource_id	Targeted vps_id (UUID string) when supplied — lets operators filter ?resource_id=<vps> to see who has triaged a given host
details	{alert_name, alert_severity, vps_hostname, fired_at, provider, model, available, confidence}
user_id / user_email	From CurrentUser (works for both JWT and API-key auth)

What's deliberately not logged

• Raw description, recent_logs, system_info, ebpf_metrics — these can carry sensitive content (auth tokens, PII, customer data). Audit logs answer "who triaged what", not "what was in the logs".
• Full LLM response body — also potentially large/sensitive. The confidence + availability summary is enough for accounting.
• 403 (RBAC denied) and 429 (rate-limit denied) — these are security events, visible in structured warn! / info! logs already. Audit logs are for legitimate operator actions.

Refactor for safety

The handler had three exit paths (no API key → degraded; LLM failed → degraded; LLM succeeded → parsed). Refactored to build the response in a single let response = match ... { ... }; binding so a single log_audit call after the match covers all three. No behaviour change; just makes "every response goes through audit" structurally obvious.

Tests

New integration test `test_triage_writes_audit_log`:

1. Operator triages a synthetic alert pinned to a fresh vps_id
2. Admin GETs /api/audit-logs?resource=ai_triage
3. Asserts total=1, action/resource/resource_id/user_email all correct, and details contains the captured alert metadata + resolved provider (anthropic default) + available: false (test env has no LLM_API_KEY)

cargo build --tests clean locally.

Docs

docs/ai-triage.{en,zh}.md gain an "Audit logging" subsection between rate-limit and OpenAPI, documenting the schema and the deliberate exclusions.

Test plan

• cargo build --tests — green locally
• CI runs the new integration test against Postgres + Redis
• Manual smoke: trigger a triage in dev, check /api/audit-logs?resource=ai_triage shows the row with the expected details

🤖 Generated with Claude Code