refactor(server): audit.WriteOrLog wrapper; migrate 13 sites (T5)

Add audit.WriteOrLog: a one-line wrapper around Write that logs at
Warn and swallows the error, matching the package contract that
audit failures must not break user-facing operations.

Migrate the 13 call sites across 7 files in internal/api/ from the
3-line "if err != nil { logger.Warn(...) }" shape to a single call.
audit.Write stays exported for tests + any future caller that
needs strict semantics.

Adds three tests: success (no log), failure-via-closed-pool (Warn
record with action+err keys), and nil-logger (no panic). Tests
skip when MINSTREL_TEST_DATABASE_URL is unset, matching the
existing harness convention.

internal/audit/audit.go

@@ -12,6 +12,7 @@ package audit
 import (
 	"context"
 	"encoding/json"
+	"log/slog"
 
 	"github.com/jackc/pgx/v5/pgtype"
 	"github.com/jackc/pgx/v5/pgxpool"
@@ -75,3 +76,15 @@ func Write(ctx context.Context, pool *pgxpool.Pool, actorID, targetID pgtype.UUI
 		Metadata: jsonMeta,
 	})
 }
+
+// WriteOrLog writes the audit row; on error, logs at Warn and swallows
+// (audit failures must not break user-facing operations — see package doc).
+// Use this when the audit is observability, not gating; use Write directly
+// when the caller needs strict semantics (e.g. tests).
+func WriteOrLog(ctx context.Context, pool *pgxpool.Pool, logger *slog.Logger, actorID, targetID pgtype.UUID, action Action, metadata map[string]any) {
+	if err := Write(ctx, pool, actorID, targetID, action, metadata); err != nil {
+		if logger != nil {
+			logger.Warn("audit failed", "action", string(action), "err", err)
+		}
+	}
+}

internal/audit/audit_test.go

@@ -1,8 +1,11 @@
 package audit_test
 
 import (
+	"bytes"
 	"context"
+	"log/slog"
 	"os"
+	"strings"
 	"testing"
 
 	"github.com/jackc/pgx/v5/pgtype"
@@ -78,6 +81,73 @@ func contains(s, sub string) bool {
 	})()
 }
 
+// TestWriteOrLog_Success exercises the happy path — when Write
+// succeeds, no log line is emitted. Skipped unless a test DB is
+// configured (no fixtures harness exists in this package beyond the
+// env-driven pool above).
+func TestWriteOrLog_Success(t *testing.T) {
+	pool := newTestPool(t)
+	var buf bytes.Buffer
+	logger := slog.New(slog.NewTextHandler(&buf, &slog.HandlerOptions{Level: slog.LevelWarn}))
+	var nilUUID pgtype.UUID
+	audit.WriteOrLog(context.Background(), pool, logger, nilUUID, nilUUID, audit.ActionRegister, nil)
+	if buf.Len() != 0 {
+		t.Errorf("expected no log output on success, got %q", buf.String())
+	}
+}
+
+// TestWriteOrLog_DBFailure_Logs forces Write to fail by passing a
+// closed pool, and asserts the logger captured a Warn record with
+// action + err keys.
+func TestWriteOrLog_DBFailure_Logs(t *testing.T) {
+	url := os.Getenv("MINSTREL_TEST_DATABASE_URL")
+	if url == "" {
+		t.Skip("MINSTREL_TEST_DATABASE_URL not set")
+	}
+	pool, err := pgxpool.New(context.Background(), url)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	pool.Close() // force subsequent ops to fail
+
+	var buf bytes.Buffer
+	logger := slog.New(slog.NewTextHandler(&buf, &slog.HandlerOptions{Level: slog.LevelWarn}))
+	var nilUUID pgtype.UUID
+	audit.WriteOrLog(context.Background(), pool, logger, nilUUID, nilUUID, audit.ActionRegister, nil)
+
+	out := buf.String()
+	if out == "" {
+		t.Fatal("expected a Warn log line on failure, got none")
+	}
+	if !strings.Contains(out, "level=WARN") {
+		t.Errorf("expected level=WARN in log line, got %q", out)
+	}
+	if !strings.Contains(out, "action=register") {
+		t.Errorf("expected action=register key in log line, got %q", out)
+	}
+	if !strings.Contains(out, "err=") {
+		t.Errorf("expected err= key in log line, got %q", out)
+	}
+}
+
+// TestWriteOrLog_NilLogger ensures a nil logger + failing pool does
+// not panic. Uses a closed pool to force the failure branch.
+func TestWriteOrLog_NilLogger(t *testing.T) {
+	url := os.Getenv("MINSTREL_TEST_DATABASE_URL")
+	if url == "" {
+		t.Skip("MINSTREL_TEST_DATABASE_URL not set")
+	}
+	pool, err := pgxpool.New(context.Background(), url)
+	if err != nil {
+		t.Fatalf("connect: %v", err)
+	}
+	pool.Close()
+
+	var nilUUID pgtype.UUID
+	// Must not panic.
+	audit.WriteOrLog(context.Background(), pool, nil, nilUUID, nilUUID, audit.ActionRegister, nil)
+}
+
 func TestWrite_AllActionConstantsArePersisted(t *testing.T) {
 	pool := newTestPool(t)
 	var nilUUID pgtype.UUID