/** One authz/PII-reveal audit row as the FE sees it (WP-41 backend → WP-42 view). Pure
    type; data-minimised (no PII) by construction on the server. */
export interface AuditEntry {
  at: string; // ISO timestamp
  action: string;
  resource: string;
  decision: 'allow' | 'deny';
  role: string;
  correlationId: string;
}