feat: punkt 7 (audit log) — export route (CSV/JSON), retention cleanup ARQ cron job (daily 03:00, 365 days default)

app/core/worker.py

@@ -342,6 +342,49 @@ async def cleanup_outbox_job(ctx: dict[str, Any]) -> None:
 register_job("cleanup_outbox", cleanup_outbox_job)
 
 
+# ── Audit log retention cleanup job ─────────────────────────────────────────
+
+async def cleanup_audit_log_job(ctx: dict[str, Any]) -> None:
+    """Delete audit log entries older than 365 days.
+
+    Runs daily to prevent the audit_log table from growing indefinitely.
+    Iterates per-tenant for RLS compliance.
+    """
+    from sqlalchemy import text as sa_text, delete as sa_delete
+    from datetime import datetime, timedelta
+
+    from app.core.db import get_worker_session_factory
+    from app.models.audit import AuditLog
+
+    factory = get_worker_session_factory()
+    async with factory() as db:
+        try:
+            tenant_result = await db.execute(sa_text("SELECT id FROM tenants"))
+            tenant_ids = [row[0] for row in tenant_result]
+
+            cutoff = datetime.utcnow() - timedelta(days=365)
+            total_deleted = 0
+            for tenant_id in tenant_ids:
+                await db.execute(
+                    sa_text("SELECT set_config('app.current_tenant_id', :tid, true)"),
+                    {"tid": str(tenant_id)},
+                )
+                result = await db.execute(
+                    sa_delete(AuditLog).where(AuditLog.timestamp < cutoff)
+                )
+                total_deleted += result.rowcount
+                await db.commit()
+
+            if total_deleted:
+                logger.info("Audit retention: cleaned up %d old entries", total_deleted)
+        except Exception:
+            logger.error("Audit retention cleanup failed", exc_info=True)
+            await db.rollback()
+
+
+register_job("cleanup_audit_log", cleanup_audit_log_job)
+
+
 class WorkerSettings:
     """ARQ worker settings."""
     functions = get_all_jobs()
@@ -371,6 +414,11 @@ class WorkerSettings:
             _wrap_cron_with_lock("cleanup_outbox", cleanup_outbox_job, ttl_seconds=300),
             minute=0,
         ),
+        # Audit log retention cleanup — daily at 03:00
+        cron(
+            _wrap_cron_with_lock("cleanup_audit_log", cleanup_audit_log_job, ttl_seconds=300),
+            hour=3, minute=0,
+        ),
         # Scheduled backup — daily at 02:00 (guarded by distributed lock)
         cron(
             _wrap_cron_with_lock("run_backup", get_job("run_backup"), ttl_seconds=600),