feat: real audit_log with redaction + pending_changes; replace stub

lib/db/repos/pending_changes.js

@@ -0,0 +1,32 @@
+import { pool } from '../pool.js';
+
+export async function create({ agent_id, entity_type, entity_id, action, payload, reason }) {
+  const { rows: [r] } = await pool.query(
+    `INSERT INTO pending_changes(agent_id, entity_type, entity_id, action, payload, reason)
+     VALUES($1,$2,$3,$4,$5,$6) RETURNING *`,
+    [agent_id, entity_type, entity_id || null, action, payload, reason || null]
+  );
+  return r;
+}
+
+export async function listPending({ limit = 100 } = {}) {
+  const { rows } = await pool.query(
+    `SELECT * FROM pending_changes WHERE status='pending' ORDER BY created_at LIMIT $1`,
+    [limit]
+  );
+  return rows;
+}
+
+export async function getById(id) {
+  const { rows: [r] } = await pool.query(`SELECT * FROM pending_changes WHERE id=$1`, [id]);
+  return r;
+}
+
+export async function resolve(id, status, resolved_by) {
+  const { rows: [r] } = await pool.query(
+    `UPDATE pending_changes SET status=$1, resolved_at=now(), resolved_by=$2
+     WHERE id=$3 AND status='pending' RETURNING *`,
+    [status, resolved_by || null, id]
+  );
+  return r;
+}