feat(audit): add TOOL_EXECUTED logging with opt-in setting

Add isToolAuditEnabled() helper that checks the auditToolOperations
DB setting (off by default) or falls back to the enterprise
audit_export feature flag. The createToolRoute factory now emits a
TOOL_EXECUTED audit entry on successful tool execution when enabled,
using a fire-and-forget pattern so a failed audit write never blocks
the tool response.

apps/api/src/lib/audit.ts

@@ -1,9 +1,39 @@
 import { randomUUID } from "node:crypto";
+import { eq } from "drizzle-orm";
 import type { FastifyBaseLogger } from "fastify";
 import { db, schema } from "../db/index.js";
 
 const MAX_AUDIT_INPUT_LENGTH = 200;
 
+/**
+ * Check whether tool operation audit logging is enabled.
+ *
+ * Two paths can enable it:
+ *   1. The `auditToolOperations` admin setting is explicitly "true".
+ *   2. An active enterprise license enables the `audit_export` feature.
+ *
+ * Returns false on any error so a broken check never blocks tool execution.
+ */
+export async function isToolAuditEnabled(): Promise<boolean> {
+  try {
+    const result = await db
+      .select({ value: schema.settings.value })
+      .from(schema.settings)
+      .where(eq(schema.settings.key, "auditToolOperations"))
+      .limit(1);
+    if (result.length > 0 && result[0].value === "true") return true;
+  } catch {
+    // fall through to enterprise check
+  }
+
+  try {
+    const enterprise = await import("@snapotter/enterprise");
+    return enterprise.isFeatureEnabled("audit_export");
+  } catch {
+    return false;
+  }
+}
+
 export function sanitizeAuditInput(raw: string): string {
   return raw.replace(/[<>&"']/g, "").slice(0, MAX_AUDIT_INPUT_LENGTH) || "(empty)";
 }

apps/api/src/routes/tool-factory.ts

@@ -469,6 +469,31 @@ export function createToolRoute<T>(app: FastifyInstance, config: ToolRouteConfig
               is_ai_tool: getBundleForTool(config.toolId) !== null,
             });
 
+            // Fire-and-forget: audit log must never block the response
+            import("../lib/audit.js")
+              .then(({ isToolAuditEnabled, auditLog }) =>
+                isToolAuditEnabled().then((enabled) => {
+                  if (!enabled) return;
+                  const user = getAuthUser(request);
+                  return auditLog(
+                    request.log,
+                    "TOOL_EXECUTED",
+                    {
+                      userId: user?.id,
+                      username: user?.username,
+                      toolId: config.toolId,
+                      inputFileCount: received.length,
+                      totalInputSize: received.reduce((sum, r) => sum + r.size, 0),
+                      outputFormat: (settings as Record<string, unknown>)?.format ?? null,
+                      status: "success",
+                      durationMs: Date.now() - startTime,
+                    },
+                    request.ip,
+                  );
+                }),
+              )
+              .catch(() => {});
+
             return reply.send({
               jobId,
               downloadUrl: `/api/v1/download/${jobId}/${encodeURIComponent(result.filename)}`,