Initial scaffold: FastAPI backend + Vue 3 frontend + Docker setup

Backend: config/db/security/logging core, SQLAlchemy models (Server,
Credential, UpdateJob, UpdateLog, AuditLog, User), services (winrm, ssh,
cau, audit, job_runner), REST API (auth, servers, updates, audit),
Socket.io WebSocket layer.
Frontend: Vue 3 + TS + Pinia + Tailwind, Views (Dashboard, Servers,
Updates, Audit, Login), axios + socket.io-client, nginx prod config.

backend/app/services/audit.py

@@ -0,0 +1,46 @@
+"""Audit service: write structured, immutable audit entries to DB."""
+
+import json
+from typing import Any
+
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.logging import get_logger
+from app.models.audit_log import AuditLog
+
+logger = get_logger(__name__)
+
+
+class AuditService:
+    """Persists audit events. Every mutating API action should call this."""
+
+    def __init__(self, db: AsyncSession) -> None:
+        self.db = db
+
+    async def log(
+        self,
+        username: str,
+        action: str,
+        target: str | None = None,
+        result: str = "success",
+        details: dict[str, Any] | None = None,
+        ip_address: str | None = None,
+    ) -> AuditLog:
+        entry = AuditLog(
+            username=username,
+            action=action,
+            target=target,
+            result=result,
+            details=json.dumps(details) if details else None,
+            ip_address=ip_address,
+        )
+        self.db.add(entry)
+        await self.db.flush()
+        logger.info(
+            "audit",
+            username=username,
+            action=action,
+            target=target,
+            result=result,
+        )
+        return entry