feat: implement sensitive operation audit retention (TASK-WP6-04)

apps/worker/src/project-purge-cleanup.ts

@@ -212,10 +212,19 @@ export class ProjectPurgeCleanup {
         transaction.immediate();
         completed += 1;
       } catch {
-        this.database.prepare(`
-          UPDATE file_cleanup_queue SET status = 'failed', last_error = 'physical_file_cleanup_failed'
-          WHERE cleanup_id = ?
-        `).run(row.cleanup_id);
+        const transaction = this.database.transaction(() => {
+          this.database.prepare(`
+            UPDATE file_cleanup_queue SET status = 'failed', last_error = 'physical_file_cleanup_failed'
+            WHERE cleanup_id = ?
+          `).run(row.cleanup_id);
+          if (row.managed_file_id && this.tableExists("asset_cleanup_request_items")) {
+            const request = this.database.prepare(`
+              SELECT request_id FROM asset_cleanup_request_items WHERE managed_file_id = ? LIMIT 1
+            `).get(row.managed_file_id) as { request_id: string } | undefined;
+            if (request) this.insertAssetCleanupFailureAudit(request.request_id, this.clock());
+          }
+        });
+        transaction.immediate();
         failed += 1;
       }
     }
@@ -296,6 +305,19 @@ export class ProjectPurgeCleanup {
     );
   }
 
+  private insertAssetCleanupFailureAudit(requestId: string, occurredAt: number) {
+    if (!this.tableExists("admin_operation_logs")) return;
+    this.database.prepare(`
+      INSERT INTO admin_operation_logs (
+        log_id, actor_type, actor_ref, operation_type, target_type, target_ref,
+        result, before_summary, after_summary, occurred_at, expires_at
+      ) VALUES (?, 'system', 'project_purge_worker', 'asset_cleanup_physical_failed', 'asset_cleanup', ?, 'failed', NULL, ?, ?, ?)
+    `).run(
+      randomUUID(), requestId, JSON.stringify({ failed_count: 1, status: "retry_pending" }), occurredAt,
+      occurredAt + auditRetentionMilliseconds,
+    );
+  }
+
   private remeasureManagedCapacity() {
     const state = this.database.prepare(`
       SELECT managed_content_bytes FROM local_backend_storage_state WHERE singleton = 1