Summary

Adds an /admin/audit-logs admin page (IT-ADMIN only) that lists every INSERT/UPDATE/DELETE event recorded by the platform's audit infrastructure. Entries are shown in a paginated, filterable table sorted by createdAt descending. There is no detail view, no editing, no row-level actions.

Spec

• Spec folder: specs/090-audit-log-view/
• Design: specs/090-audit-log-view/design.md
• Behaviors: specs/090-audit-log-view/behaviors.md
• Steps: specs/090-audit-log-view/steps.md

Changes

Backend

• AuditLogController exposes GET /api/audit-logs (paginated, optional entityType / user filters, fixed createdAt DESC sort) and GET /api/audit-logs/entity-types (distinct values for the filter dropdown). Both endpoints are gated by class-level @RequiresItAdmin.
• CrmAuditLogRepository is a project-local Spring Data repository over AuditLogEntity (from com.open-elements:spring-services). It exists because the dependency's AuditLogDataService exposes only unpaginated List-returning filter methods, which would force in-memory pagination over an unbounded audit table. The fix preserves the design's contract (DB-layer pagination) without modifying the dependency.

Frontend

• New server page app/(app)/admin/audit-logs/page.tsx — checks ROLE_IT_ADMIN, falls back to <ForbiddenPage />.
• New client component audit-logs-client.tsx — paginated table (Type / Entity ID / Action / User / Date), two filter dropdowns, page-size selector (10/20/50/100/200, persisted in localStorage["pageSize.auditLogs"], default 20), loading skeleton, empty state, error state. The user dropdown is populated from getUsers({ size: 200 }) and excludes the synthetic System user.
• Sidebar entry under the existing Admin sub-menu (FileText icon).
• New API helpers getAuditLogs and getAuditLogEntityTypes in frontend/src/lib/api.ts; new AuditLogDto / AuditAction types in frontend/src/lib/types.ts.
• nav.auditLogs + full auditLog namespace added to both de.ts and en.ts.

Documentation

• project-features.md and project-structure.md updated. Two pre-existing UTF-8 corruption marks (U+FFFD) in project-structure.md were repaired in the same edit.

Deviation from design.md

The design referenced auditLogDataService.findByEntityType(entityType, pageable) etc. The actual AuditLogDataService API only provides unpaginated List-returning filter methods. The implementation introduces a small project-local repository to keep filtering at the DB layer; the endpoint contract, query parameters, and response payload are unchanged. The full reasoning is recorded at the top of specs/090-audit-log-view/steps.md.

Test coverage

• 36 behavioural scenarios in behaviors.md mapped to tests in the coverage table at the top of steps.md.
• Backend: 9 controller tests (AuditLogControllerTest), 8 role-integration tests (SecurityRoleIntegrationTest), 1 annotation test (PreAuthorizeAnnotationTest). Full backend suite green: 58/58.
• Frontend: 19 Vitest component tests for AuditLogsClient (loading / empty / error / table rendering / System-user row / pagination defaults / localStorage persistence / page-size resets / dropdown population). All pass.
• Filter-interaction scenarios that depend on Radix <Select> popover content are not asserted via DOM events — same jsdom limitation accepted in spec 089's review. The filter logic itself is exercised by the backend filter tests for every parameter combination.

Test plan

• cd backend && ./mvnw verify
• cd frontend && pnpm test src/app/\(app\)/admin/audit-logs/__tests__/audit-logs-client.test.tsx
• Manually browse /admin/audit-logs as an IT-ADMIN user and verify table content + filter behaviour against a populated audit log.
• Verify the page returns a ForbiddenPage when accessed without IT-ADMIN.
• Verify the sidebar entry is hidden for non-IT-ADMIN users.

Closes #3

🤖 Generated with Claude Code