feat: double audit — impersonated_by in audit_log

- db.js: add impersonated_by column to audit_log
- queries.js: logAudit accepts impersonatedBy, all CRUD pass it
- api/routes/entries.js: pass req.user.originalUserEmail as impersonatedBy
- При имперсонации: created_by=импактируемый, impersonated_by=админ

src/api/routes/entries.js

@@ -121,7 +121,7 @@ function createEntriesRouter({ q }) {
     if (comment && comment.length > 255) return res.status(400).json({ error: 'Комментарий слишком длинный (максимум 255 символов)' });
     try {
       const company = await resolveCompany(req);
-      const { entry, wasNormalized } = await q.createEntry(company.id, value, comment || '', req.user.email);
+      const { entry, wasNormalized } = await q.createEntry(company.id, value, comment || '', req.user.email, req.user.originalUserEmail);
       res.status(201).json({ entry, wasNormalized });
     } catch (e) {
       if (e.status) return res.status(e.status).json({ error: e.message });
@@ -136,7 +136,7 @@ function createEntriesRouter({ q }) {
     if (comment && comment.length > 255) return res.status(400).json({ error: 'Комментарий слишком длинный (максимум 255 символов)' });
     try {
       const company = await resolveCompany(req);
-      const { entry, wasNormalized } = await q.updateEntry(req.params.id, company.id, value, comment ?? '', req.user.email);
+      const { entry, wasNormalized } = await q.updateEntry(req.params.id, company.id, value, comment ?? '', req.user.email, req.user.originalUserEmail);
       res.json({ entry, wasNormalized });
     } catch (e) {
       if (e.status) return res.status(e.status).json({ error: e.message });
@@ -148,7 +148,7 @@ function createEntriesRouter({ q }) {
   router.delete('/:id', async (req, res) => {
     try {
       const company = await resolveCompany(req);
-      await q.deleteEntry(req.params.id, company.id, req.user.email);
+      await q.deleteEntry(req.params.id, company.id, req.user.email, req.user.originalUserEmail);
       res.status(204).send();
     } catch (e) {
       if (e.status) return res.status(e.status).json({ error: e.message });