feat(audit): add TOOL_EXECUTED logging with opt-in setting

Add isToolAuditEnabled() helper that checks the auditToolOperations
DB setting (off by default) or falls back to the enterprise
audit_export feature flag. The createToolRoute factory now emits a
TOOL_EXECUTED audit entry on successful tool execution when enabled,
using a fire-and-forget pattern so a failed audit write never blocks
the tool response.

apps/api/src/routes/tool-factory.ts

@@ -469,6 +469,31 @@ export function createToolRoute<T>(app: FastifyInstance, config: ToolRouteConfig
               is_ai_tool: getBundleForTool(config.toolId) !== null,
             });
 
+            // Fire-and-forget: audit log must never block the response
+            import("../lib/audit.js")
+              .then(({ isToolAuditEnabled, auditLog }) =>
+                isToolAuditEnabled().then((enabled) => {
+                  if (!enabled) return;
+                  const user = getAuthUser(request);
+                  return auditLog(
+                    request.log,
+                    "TOOL_EXECUTED",
+                    {
+                      userId: user?.id,
+                      username: user?.username,
+                      toolId: config.toolId,
+                      inputFileCount: received.length,
+                      totalInputSize: received.reduce((sum, r) => sum + r.size, 0),
+                      outputFormat: (settings as Record<string, unknown>)?.format ?? null,
+                      status: "success",
+                      durationMs: Date.now() - startTime,
+                    },
+                    request.ip,
+                  );
+                }),
+              )
+              .catch(() => {});
+
             return reply.send({
               jobId,
               downloadUrl: `/api/v1/download/${jobId}/${encodeURIComponent(result.filename)}`,