feat: Phase 3 - AES encryption, SQL audit engine, audit logs (85 tests)

Phase 3.1: Instance password AES-256-GCM encryption
Phase 3.2: SQL audit rule engine (10 rules)
Phase 3.3: Auto-audit on ticket creation
Phase 3.4: Operation audit logs + GET /audit/logs
Tests: 44 -> 85 (41 new), Frontend: AuditLogsPage

backend/app/api/v1/endpoints/user.py

@@ -8,6 +8,7 @@ from app.core.database import get_db
 from app.core.security import get_current_user, hash_password, require_role
 from app.models.user import User
 from app.schemas.user import UserCreate, UserUpdate, UserResponse
+from app.services.audit_log_service import AuditLogService
 
 router = APIRouter(prefix="/users", tags=["用户管理"])
 
@@ -47,6 +48,12 @@ async def create_user(
         hashed_password=hash_password(data.password),
     )
     db.add(user)
+    await db.flush()
+    await AuditLogService.log(
+        db, user_id=current_user.id, action="CREATE_USER",
+        target_type="user", target_id=user.id,
+        detail=f"创建用户: {data.username} ({data.role})",
+    )
     await db.commit()
     await db.refresh(user)
     return user
@@ -99,6 +106,11 @@ async def delete_user(
     if not user:
         raise HTTPException(status_code=404, detail="用户不存在")
 
+    await AuditLogService.log(
+        db, user_id=current_user.id, action="DELETE_USER",
+        target_type="user", target_id=user.id,
+        detail=f"删除用户: {user.username}",
+    )
     await db.delete(user)
     await db.commit()
     return {"message": "用户已删除"}