docs(core): move the audit-log rationale beside the model

The applied migration file is checksummed by prisma migrate, so commenting it
after the fact makes every database that already ran it report drift. The
schema comment carries the same rationale without touching migration history.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CLSaVXhLYJxH6DS9mDjiB

Author: ka1kqi

frontend/packages/core/prisma/migrations/20260826000000_add_audit_logs/migration.sql

@@ -1,23 +1,3 @@
--- The audit trail for non-interactive writes.
---
--- Purpose: one append-only row per write that changes account state, recording
--- who (actor_user_id), what (operation, resource, summary), where (workspace/
--- project), and crucially HOW — transport distinguishes a public-API call from
--- an in-app agent action (with its session), because "who" alone no longer
--- identifies the author's intent once machines write on a user's behalf.
---
--- Why this table did not exist before: every write used to be a human in the
--- UI on their own cookie session — the actor was the session, the intent was
--- the click, and the result was on screen. Attribution was structural.
---
--- Why it is needed now: the public write API lets the CLI, the in-app agent,
--- and any credential holder create resources with no human watching. Once a
--- dashboard can appear without anyone having clicked, "where did this come
--- from" must be answerable from storage. Deliberately no foreign keys: audit
--- rows must survive the deletion of everything they describe. UI writes will
--- join this trail (transport "ui") when the cookie routes move to the shared
--- write services.
-
 -- CreateTable
 CREATE TABLE "audit_logs" (
     "id" VARCHAR NOT NULL,

frontend/packages/core/prisma/schema.prisma

@@ -789,6 +789,17 @@ model Widget {
   @@map("widgets")
 }
 
+// The audit trail for non-interactive writes: one append-only row per write
+// that changes account state — who (actorUserId), what (operation, resource,
+// summary), where (workspace/project), and HOW: `transport` distinguishes a
+// public-API call from an in-app agent action (with its session id), because
+// "who" alone stops identifying intent once machines write on a user's behalf.
+// This table is new with the public write paths — before them, every write was
+// a human in the UI on their own cookie session, so attribution was structural
+// (the actor WAS the session, the result was on screen). Once the CLI, agent,
+// and API can create resources with no human watching, provenance has to be
+// answerable from storage. UI writes join the trail (transport "ui") when the
+// cookie routes migrate onto the shared write services.
 // No relations on purpose: audit rows must survive resource deletion (an FK
 // cascade would erase history).
 model AuditLog {