feat: implement audit trail alignment (soft delete & permission audit)

- Task Soft Delete:
  - Add is_deleted, deleted_at, deleted_by fields to Task model
  - Convert DELETE to soft delete with cascade to subtasks
  - Add include_deleted query param (admin only)
  - Add POST /api/tasks/{id}/restore endpoint
  - Exclude deleted tasks from subtask_count

- Permission Change Audit:
  - Add user.role_change event (high sensitivity)
  - Add user.admin_change event (critical, triggers alert)
  - Add PATCH /api/users/{id}/admin endpoint
  - Add role.permission_change event type

- Append-Only Enforcement:
  - Add DB triggers for audit_logs immutability (manual for production)
  - Migration 008 with graceful trigger failure handling

- Tests: 11 new soft delete tests (153 total passing)
- OpenSpec: fix-audit-trail archived, fix-realtime-notifications & fix-weekly-report proposals added

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

backend/app/models/audit_log.py

@@ -27,6 +27,7 @@ EVENT_SENSITIVITY = {
     "task.create": SensitivityLevel.LOW,
     "task.update": SensitivityLevel.LOW,
     "task.delete": SensitivityLevel.MEDIUM,
+    "task.restore": SensitivityLevel.MEDIUM,
     "task.assign": SensitivityLevel.LOW,
     "task.blocker": SensitivityLevel.MEDIUM,
     "project.create": SensitivityLevel.MEDIUM,
@@ -34,14 +35,17 @@ EVENT_SENSITIVITY = {
     "project.delete": SensitivityLevel.HIGH,
     "user.login": SensitivityLevel.LOW,
     "user.logout": SensitivityLevel.LOW,
+    "user.role_change": SensitivityLevel.HIGH,
+    "user.admin_change": SensitivityLevel.CRITICAL,
     "user.permission_change": SensitivityLevel.CRITICAL,
+    "role.permission_change": SensitivityLevel.CRITICAL,
     "attachment.upload": SensitivityLevel.LOW,
     "attachment.download": SensitivityLevel.LOW,
     "attachment.delete": SensitivityLevel.MEDIUM,
 }
 
 # Events that should trigger alerts
-ALERT_EVENTS = {"project.delete", "user.permission_change"}
+ALERT_EVENTS = {"project.delete", "user.permission_change", "user.admin_change", "role.permission_change"}
 
 
 class AuditLog(Base):