Audit logs and safer migrations

Audit logs (Enterprise)

Every change to API key restrictions and branch protection is recorded with its actor and target, and listed on a new Audit log page in the dashboard with filters per action. Archives go to a dedicated storage destination, separate from update assets, configured with ARCHIVE_AUDIT_LOGS, AUDIT_LOGS_EXPORT_INTERVAL_SECONDS, LOCAL_AUDIT_LOGS_BASE_PATH and AUDIT_LOG_RETENTION_DAYS. No event is written on an unlicensed server.

Migrations take an advisory lock

RunDBMigrations acquires a session-scoped PostgreSQL advisory lock before running. With several replicas booting at once, one migrates and the others wait, instead of racing on the same migration.

Bucket concurrency

Parallel copy and delete operations on GCS and S3 now run under an errgroup: the first error cancels the rest and is propagated instead of being lost in a channel. The republish handler logs request ids and tells expected errors from unexpected ones.