gate4: use separate API session for audit log in confirm_password_reset

app/services/auth_service.py

@@ -335,19 +335,24 @@ class AuthService:
         except Exception:
             logger.warning("Failed to invalidate Redis sessions for user %s", user.id, exc_info=True)
 
-        # Audit log entry for password reset
+        # Audit log entry for password reset — use separate API session (crm_api)
+        # to avoid requiring audit_log INSERT grants on crm_auth
         try:
-            from app.core.db import set_tenant_context
-            await set_tenant_context(db, reset_token.tenant_id)
-            await log_audit(
-                db,
-                reset_token.tenant_id,
-                user.id,
-                "password_reset",
-                "user",
-                user.id,
-                changes={"action": "password_changed"},
-            )
+            from app.core.db import get_api_engine, set_tenant_context
+            from sqlalchemy.ext.asyncio import AsyncSession
+            api_engine = get_api_engine()
+            async with AsyncSession(api_engine) as audit_db:
+                await set_tenant_context(audit_db, reset_token.tenant_id)
+                await log_audit(
+                    audit_db,
+                    reset_token.tenant_id,
+                    user.id,
+                    "password_reset",
+                    "user",
+                    user.id,
+                    changes={"action": "password_changed"},
+                )
+                await audit_db.commit()
         except Exception:
             logger.warning("Failed to create audit log for password reset of user %s", user.id, exc_info=True)