fix(housekeeping): preserve audit failure evidence

src/lib/services/audit.test.ts

@@ -237,4 +237,21 @@ describe("getAuditLogs", () => {
 		const result = await getAuditLogs();
 		expect(result.rows[0].username).toBe("User #99");
 	});
+	it("fails closed beyond the redaction depth cap without mutating the input", async () => {
+		const sentinel = "raw-depth-secret";
+		const deep = {
+			a: { b: { c: { d: { e: { f: { g: { secret: sentinel } } } } } } },
+		};
+		insertValues.mockResolvedValue({ id: 1 });
+		await logAudit({
+			userId: 1,
+			action: "update",
+			target: "user",
+			before: { deep, state: "before" },
+			after: { deep, state: "after" },
+		});
+		const data = insertValues.mock.calls[0][0];
+		expect(`${data.before}${data.after}${data.diff}`).not.toContain(sentinel);
+		expect(deep.a.b.c.d.e.f.g.secret).toBe(sentinel);
+	});
 });