Add audit logging for sensitive operations

Structured logging with request ID correlation throughout:
- Auth: register, login success, login failure (warn level)
- Accounts: soft-delete
- Members: move between accounts
- Tax exemptions: approve (info), revoke (warn with reason)
- Files: upload, delete (already had logging)

All logs include userId, entityId, and contextual data for debugging.
4xx errors logged as warn, 5xx as error.

packages/backend/src/routes/v1/accounts.ts

@@ -63,6 +63,7 @@ export const accountRoutes: FastifyPluginAsync = async (app) => {
     const { id } = request.params as { id: string }
     const account = await AccountService.softDelete(app.db, request.companyId, id)
     if (!account) return reply.status(404).send({ error: { message: 'Account not found', statusCode: 404 } })
+    request.log.info({ accountId: id, userId: request.user.id }, 'Account soft-deleted')
     return reply.send(account)
   })
 
@@ -129,6 +130,7 @@ export const accountRoutes: FastifyPluginAsync = async (app) => {
 
     const member = await MemberService.move(app.db, request.companyId, id, targetAccountId)
     if (!member) return reply.status(404).send({ error: { message: 'Member not found', statusCode: 404 } })
+    request.log.info({ memberId: id, targetAccountId, userId: request.user.id }, 'Member moved to account')
     return reply.send(member)
   })
 
@@ -294,6 +296,7 @@ export const accountRoutes: FastifyPluginAsync = async (app) => {
     const { id } = request.params as { id: string }
     const exemption = await TaxExemptionService.approve(app.db, request.companyId, id, request.user.id)
     if (!exemption) return reply.status(404).send({ error: { message: 'Tax exemption not found', statusCode: 404 } })
+    request.log.info({ exemptionId: id, accountId: exemption.accountId, userId: request.user.id }, 'Tax exemption approved')
     return reply.send(exemption)
   })
 
@@ -305,6 +308,7 @@ export const accountRoutes: FastifyPluginAsync = async (app) => {
     }
     const exemption = await TaxExemptionService.revoke(app.db, request.companyId, id, request.user.id, reason)
     if (!exemption) return reply.status(404).send({ error: { message: 'Tax exemption not found', statusCode: 404 } })
+    request.log.warn({ exemptionId: id, accountId: exemption.accountId, userId: request.user.id, reason }, 'Tax exemption revoked')
     return reply.send(exemption)
   })
 }