fix: audit_logs, tax_rules, reviews tables never existed; fix wrong column in review creation

Finished the sweep of every table referenced by live Rust code but not
created by any active migration:

- audit_logs / audit_log_changes — backs wallet::audit() (crates/wallet),
  called from every admin Tracecoin balance adjustment
  (apps/payments/src/admin.rs::adjust_credits). actor_type defaulted since
  the only caller doesn't supply it.
- tax_rules — backs the admin tax-rule CRUD in apps/payments/src/admin.rs.
  init-db.sql has a differently-named version (title/percentage/
  applicable_to); schema here matches the live code's actual columns
  (name/tax_rate/applies_to).
- reviews — backs the professional review/rating system
  (apps/users/src/handlers/reviews.rs).

Also fixed a real bug found while building the reviews schema:
admin_create_review's customer-lookup subquery selected
`lead_requests.user_id`, a column that has never existed (it's
`customer_user_id`) — would have failed on the very first review
creation attempt now that lead_requests actually exists.

Checked every other previously-flagged table (permissions, orders,
external_roles, internal_roles, kb_*, notification_*, order_items,
portfolio_images, smtp_configs, dashboard_widgets,
verification_documents) against actual Rust usage — none of them are
referenced by a real SQL query (grep hits were all Rust variable/type
names), so nothing to fix there. Full migration-chain sweep confirms
zero remaining "references a table before it's created" issues.

apps/users/src/handlers/reviews.rs

@@ -140,7 +140,7 @@ async fn admin_create_review(
         r#"
         INSERT INTO reviews (lead_request_id, customer_id, professional_id, rating, comment, is_published)
         SELECT $1,
-               (SELECT id FROM customer_profiles WHERE user_id = (SELECT user_id FROM lead_requests WHERE id = $1)),
+               (SELECT id FROM customer_profiles WHERE user_id = (SELECT customer_user_id FROM lead_requests WHERE id = $1)),
                (SELECT user_role_profile_id FROM lead_requests WHERE id = $1),
                $2, $3, true
         RETURNING id, lead_request_id, customer_id, professional_id, rating, comment, is_published, created_at

crates/db/migrations/20260721050000_create_audit_logs.down.sql

@@ -0,0 +1,2 @@
+DROP TABLE IF EXISTS audit_log_changes;
+DROP TABLE IF EXISTS audit_logs;

crates/db/migrations/20260721050000_create_audit_logs.up.sql

@@ -0,0 +1,34 @@
+-- Backs wallet::audit() (crates/wallet/src/lib.rs), called from every admin
+-- Tracecoin balance adjustment (apps/payments/src/admin.rs::adjust_credits).
+-- Never created by any active migration — only in scripts/init-db.sql (see
+-- 20260718200000_create_verifications_and_approvals for why that file is
+-- never actually applied). actor_type/request_id/ip_address/user_agent are
+-- nullable/defaulted here since the only current caller doesn't supply them.
+CREATE TABLE IF NOT EXISTS audit_logs (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    actor_user_id UUID NOT NULL,
+    actor_type VARCHAR(20) NOT NULL DEFAULT 'USER',
+    action VARCHAR(100) NOT NULL,
+    entity_type VARCHAR(50) NOT NULL,
+    entity_id UUID NOT NULL,
+    module_key VARCHAR(100),
+    request_id UUID,
+    ip_address VARCHAR(45),
+    user_agent TEXT,
+    status VARCHAR(20) NOT NULL DEFAULT 'SUCCESS',
+    summary TEXT,
+    metadata_json JSONB,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_audit_logs_entity ON audit_logs(entity_type, entity_id);
+CREATE INDEX IF NOT EXISTS idx_audit_logs_actor ON audit_logs(actor_type, actor_user_id);
+CREATE INDEX IF NOT EXISTS idx_audit_logs_created_at ON audit_logs(created_at DESC);
+
+CREATE TABLE IF NOT EXISTS audit_log_changes (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    audit_log_id UUID NOT NULL REFERENCES audit_logs(id) ON DELETE CASCADE,
+    field_name VARCHAR(255) NOT NULL,
+    old_value TEXT,
+    new_value TEXT,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);

crates/db/migrations/20260721060000_create_tax_rules_and_reviews.down.sql

@@ -0,0 +1,2 @@
+DROP TABLE IF EXISTS reviews;
+DROP TABLE IF EXISTS tax_rules;

crates/db/migrations/20260721060000_create_tax_rules_and_reviews.up.sql

@@ -0,0 +1,31 @@
+-- tax_rules backs apps/payments/src/admin.rs's admin tax-rule CRUD. Never
+-- created by any active migration; init-db.sql has a differently-named
+-- version (title/percentage/applicable_to) that doesn't match what the live
+-- code reads/writes (name/tax_rate/applies_to) — schema below matches the
+-- Rust code exactly.
+CREATE TABLE IF NOT EXISTS tax_rules (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    name VARCHAR(255) NOT NULL,
+    tax_type VARCHAR(50) NOT NULL,
+    tax_rate NUMERIC(5,2) NOT NULL,
+    applies_to VARCHAR(50),
+    is_active BOOLEAN NOT NULL DEFAULT true,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+
+-- reviews backs apps/users/src/handlers/reviews.rs (professional review/
+-- rating system, sourced from completed lead_requests). Same story — only
+-- ever existed in scripts/init-db.sql, never applied.
+CREATE TABLE IF NOT EXISTS reviews (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    lead_request_id UUID REFERENCES lead_requests(id) ON DELETE SET NULL,
+    customer_id UUID,
+    professional_id UUID,
+    rating SMALLINT NOT NULL,
+    comment TEXT,
+    is_published BOOLEAN NOT NULL DEFAULT true,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);
+CREATE INDEX IF NOT EXISTS idx_reviews_professional_id ON reviews(professional_id);
+CREATE INDEX IF NOT EXISTS idx_reviews_customer_id ON reviews(customer_id);