feat: implement audit trail alignment (soft delete & permission audit)

- Task Soft Delete:
  - Add is_deleted, deleted_at, deleted_by fields to Task model
  - Convert DELETE to soft delete with cascade to subtasks
  - Add include_deleted query param (admin only)
  - Add POST /api/tasks/{id}/restore endpoint
  - Exclude deleted tasks from subtask_count

- Permission Change Audit:
  - Add user.role_change event (high sensitivity)
  - Add user.admin_change event (critical, triggers alert)
  - Add PATCH /api/users/{id}/admin endpoint
  - Add role.permission_change event type

- Append-Only Enforcement:
  - Add DB triggers for audit_logs immutability (manual for production)
  - Migration 008 with graceful trigger failure handling

- Tests: 11 new soft delete tests (153 total passing)
- OpenSpec: fix-audit-trail archived, fix-realtime-notifications & fix-weekly-report proposals added

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/models/audit_log.py

@@ -27,6 +27,7 @@ EVENT_SENSITIVITY = {
     "task.create": SensitivityLevel.LOW,
     "task.update": SensitivityLevel.LOW,
     "task.delete": SensitivityLevel.MEDIUM,
+    "task.restore": SensitivityLevel.MEDIUM,
     "task.assign": SensitivityLevel.LOW,
     "task.blocker": SensitivityLevel.MEDIUM,
     "project.create": SensitivityLevel.MEDIUM,
@@ -34,14 +35,17 @@ EVENT_SENSITIVITY = {
     "project.delete": SensitivityLevel.HIGH,
     "user.login": SensitivityLevel.LOW,
     "user.logout": SensitivityLevel.LOW,
+    "user.role_change": SensitivityLevel.HIGH,
+    "user.admin_change": SensitivityLevel.CRITICAL,
     "user.permission_change": SensitivityLevel.CRITICAL,
+    "role.permission_change": SensitivityLevel.CRITICAL,
     "attachment.upload": SensitivityLevel.LOW,
     "attachment.download": SensitivityLevel.LOW,
     "attachment.delete": SensitivityLevel.MEDIUM,
 }
 
 # Events that should trigger alerts
-ALERT_EVENTS = {"project.delete", "user.permission_change"}
+ALERT_EVENTS = {"project.delete", "user.permission_change", "user.admin_change", "role.permission_change"}
 
 
 class AuditLog(Base):

backend/app/models/task.py

@@ -36,12 +36,18 @@ class Task(Base):
     created_at = Column(DateTime, server_default=func.now(), nullable=False)
     updated_at = Column(DateTime, server_default=func.now(), onupdate=func.now(), nullable=False)
 
+    # Soft delete fields
+    is_deleted = Column(Boolean, default=False, nullable=False, index=True)
+    deleted_at = Column(DateTime, nullable=True)
+    deleted_by = Column(String(36), ForeignKey("pjctrl_users.id"), nullable=True)
+
     # Relationships
     project = relationship("Project", back_populates="tasks")
     parent_task = relationship("Task", remote_side=[id], back_populates="subtasks")
     subtasks = relationship("Task", back_populates="parent_task", cascade="all, delete-orphan")
     assignee = relationship("User", foreign_keys=[assignee_id], back_populates="assigned_tasks")
     creator = relationship("User", foreign_keys=[created_by], back_populates="created_tasks")
+    deleter = relationship("User", foreign_keys=[deleted_by])
     status = relationship("TaskStatus", back_populates="tasks")
 
     # Collaboration relationships