fix: stop the commandocentrum audit call leaking an unhandled rejection

The full suite passed but exited non-zero, which fails CI: three unhandled
rejections came out of commandocentrum's fire-and-forget audit call.

The cause is a real defect, not a test artefact. `auditAction` wrapped
`logAudit(...)` in a try/catch to honour "auditing must never fail the command
it describes", but logAudit is async, so the catch can never see its rejection.
A failing audit insert therefore surfaced as an unhandled rejection instead of
being swallowed — in production that is a request taking down over a logging
failure. The catch is now on the promise itself.

The test now mocks the audit service explicitly instead of leaning on the fake
db lacking `insert`, and asserts both that an entry is logged and that a
rejecting audit still lets the command succeed.

src/actions/commandocentrum.ts

@@ -24,11 +24,16 @@ function auditAction(
 	targetId: number,
 	after: Record<string, unknown>,
 ): void {
-	try {
-		logAudit({ userId, action, target: "User", targetId, after });
-	} catch {
-		/* auditing must never fail the command it describes */
-	}
+	// logAudit is async, so a surrounding try/catch cannot see its rejection —
+	// it would surface as an unhandled rejection and, in production, take the
+	// request down over a failing audit insert. Swallow it on the promise
+	// instead, which is what "auditing must never fail the command it
+	// describes" actually requires.
+	void Promise.resolve()
+		.then(() => logAudit({ userId, action, target: "User", targetId, after }))
+		.catch(() => {
+			/* auditing must never fail the command it describes */
+		});
 }
 
 async function requireRconOk(ok: boolean): Promise<void> {