Add workspace audit history

.changeset/fumadb-bounded-mysql-ids.md

@@ -0,0 +1,5 @@
+---
+"@executor-js/fumadb": major
+---
+
+MySQL Drizzle schema generation now rejects unbounded string primary keys instead of emitting invalid `text` primary-key SQL. Before upgrading, change every MySQL `idColumn(..., "string")` to an explicit bound such as `idColumn(..., "varchar(255)")` (or use `"uuid"`). The `IdColumnType` type is now exported from `@executor-js/fumadb/schema` for reusable schema helpers.

.changeset/workspace-audit-history.md

@@ -0,0 +1,17 @@
+---
+"@executor-js/sdk": minor
+"@executor-js/api": minor
+---
+
+**Workspace audit history**
+
+Connection, integration, OAuth-client, and tool-policy mutations now append
+tenant-scoped audit events containing only actor and safe resource identifiers.
+Admins can inspect the history in the Users page Activity tab or through
+`GET /admin/audit-events`.
+
+The history records `created`, `updated`, and `removed` row intent. When
+post-commit credential persistence fails, successful row compensation appends
+`rolled_back`; a later provider-cleanup failure appends `rollback_failed`, so
+the history never claims complete compensation when credential restoration was
+incomplete.

apps/cloud/drizzle/0018_redundant_forge.sql

@@ -0,0 +1,14 @@
+CREATE TABLE "audit_event" (
+	"id" text NOT NULL,
+	"actor_id" text,
+	"action" text NOT NULL,
+	"resource_type" text NOT NULL,
+	"resource_owner" text,
+	"resource_parent" text,
+	"resource_id" text NOT NULL,
+	"created_at" timestamp NOT NULL,
+	"row_id" text PRIMARY KEY NOT NULL,
+	"tenant" text NOT NULL
+);
+--> statement-breakpoint
+CREATE UNIQUE INDEX "audit_event_uidx" ON "audit_event" USING btree ("tenant","created_at","id");