Task #147: Add structured permission-change audit (users, groups, apps)

Mirrors the existing role-permission audit pattern with a unified
`permission_audit` table capturing actor, target, prev/new id sets, and
timestamp written in the same transaction as the change.

Schema & API
- New `permission_audit` table (target_kind, target_id, change_kind,
  actor_user_id, previous_ids[], new_ids[], created_at) with index on
  (target_kind, target_id, created_at).
- Transactional audit writes in routes/users.ts (POST/DELETE roles,
  PATCH groupIds), routes/groups.ts (PATCH + add/remove members for
  users/roles/apps), routes/apps.ts (POST/DELETE permissions).
- Cross-entity mirroring: when group membership changes via a group
  endpoint, a user.groups row is also written for each affected user
  (and vice versa via PATCH /users), so each entity's history is
  exhaustive regardless of which editor was used.
- Admin-only GET /users/:id/audit, /groups/:id/audit, /apps/:id/audit
  with limit/offset/actorUserId/from/to filters and the same response
  shape as role audit.
- OpenAPI types + codegen regenerated.

UI
- Reusable PermissionAuditHistory component in admin.tsx wired into
  UserGroupsEditor, GroupDetailEditor (new "history" tab), and the
  editing-app dialog. App history correctly resolves permission ids
  (NOT roles) via useListPermissions.
- Bilingual i18n keys added under admin.{users,groups,apps}.history*
  in en.json + ar.json.

Tests
- New backend tests: user-permission-audit, group-permission-audit,
  app-permission-audit (14 cases — transactional capture, GET filters
  & pagination, admin-only, 404 on unknown id, plus 2 new mirror
  tests covering cross-entity audit visibility). All pass; 35
  adjacent role/groups/users/audit-coverage tests still pass.

Notes
- replit.md updated to list `permission_audit` table.
- Restored opengraph.jpg (an unrelated stray binary diff).
- Code-review comments addressed: cross-entity asymmetry fixed via
  mirroring; opengraph.jpg restored.
- Follow-ups proposed: timeline UI improvements, cascade audit on
  delete/bulk paths, e2e UI test for History sections.

Replit-Task-Id: 4ba8c8de-8dfd-42c7-a3bc-964a1ed3a1a3

artifacts/tx-os/src/locales/ar.json

@@ -437,6 +437,34 @@
         "orders": "{{count}} طلب",
         "conversations": "{{count}} محادثة",
         "messages": "{{count}} رسالة"
+      },
+      "historyTitle": "سجل الصلاحيات",
+      "historyHint": "الأدوار والمجموعات المسندة لهذا المستخدم. صفِّ بحسب من غيّر أو متى.",
+      "historyEmpty": "لم تُسجَّل تغييرات صلاحيات لهذا المستخدم بعد.",
+      "historyEmptyFiltered": "لا توجد تغييرات صلاحيات تطابق الفلاتر الحالية.",
+      "historyAdded_zero": "أُضيف ({{count}}):",
+      "historyAdded_one": "أُضيف ({{count}}):",
+      "historyAdded_two": "أُضيف ({{count}}):",
+      "historyAdded_few": "أُضيف ({{count}}):",
+      "historyAdded_many": "أُضيف ({{count}}):",
+      "historyAdded_other": "أُضيف ({{count}}):",
+      "historyRemoved_zero": "أُزيل ({{count}}):",
+      "historyRemoved_one": "أُزيل ({{count}}):",
+      "historyRemoved_two": "أُزيل ({{count}}):",
+      "historyRemoved_few": "أُزيل ({{count}}):",
+      "historyRemoved_many": "أُزيل ({{count}}):",
+      "historyRemoved_other": "أُزيل ({{count}}):",
+      "historyTotal_zero": "{{count}} عنصر بعد التغيير",
+      "historyTotal_one": "{{count}} عنصر بعد التغيير",
+      "historyTotal_two": "{{count}} عنصران بعد التغيير",
+      "historyTotal_few": "{{count}} عناصر بعد التغيير",
+      "historyTotal_many": "{{count}} عنصراً بعد التغيير",
+      "historyTotal_other": "{{count}} عنصر بعد التغيير",
+      "history": {
+        "kind": {
+          "roles": "الأدوار",
+          "groups": "المجموعات"
+        }
       }
     },
     "apps": {
@@ -444,7 +472,29 @@
         "groups": "{{count}} مجموعة",
         "restrictions": "{{count}} قيد",
         "opens": "{{count}} فتحة"
-      }
+      },
+      "historyTitle": "سجل الصلاحيات",
+      "historyHint": "الصلاحيات المطلوبة لاستخدام هذا التطبيق. صفِّ بحسب من غيّر أو متى.",
+      "historyEmpty": "لم تُسجَّل تغييرات صلاحيات لهذا التطبيق بعد.",
+      "historyEmptyFiltered": "لا توجد تغييرات صلاحيات تطابق الفلاتر الحالية.",
+      "historyAdded_zero": "أُضيف ({{count}}):",
+      "historyAdded_one": "أُضيف ({{count}}):",
+      "historyAdded_two": "أُضيف ({{count}}):",
+      "historyAdded_few": "أُضيف ({{count}}):",
+      "historyAdded_many": "أُضيف ({{count}}):",
+      "historyAdded_other": "أُضيف ({{count}}):",
+      "historyRemoved_zero": "أُزيل ({{count}}):",
+      "historyRemoved_one": "أُزيل ({{count}}):",
+      "historyRemoved_two": "أُزيل ({{count}}):",
+      "historyRemoved_few": "أُزيل ({{count}}):",
+      "historyRemoved_many": "أُزيل ({{count}}):",
+      "historyRemoved_other": "أُزيل ({{count}}):",
+      "historyTotal_zero": "{{count}} صلاحية بعد التغيير",
+      "historyTotal_one": "{{count}} صلاحية بعد التغيير",
+      "historyTotal_two": "{{count}} صلاحيتان بعد التغيير",
+      "historyTotal_few": "{{count}} صلاحيات بعد التغيير",
+      "historyTotal_many": "{{count}} صلاحية بعد التغيير",
+      "historyTotal_other": "{{count}} صلاحية بعد التغيير"
     },
     "services": {
       "counts": {
@@ -562,7 +612,37 @@
         "info": "المعلومات",
         "apps": "التطبيقات",
         "users": "المستخدمون",
-        "roles": "الأدوار"
+        "roles": "الأدوار",
+        "history": "السجل"
+      },
+      "historyTitle": "سجل الصلاحيات",
+      "historyHint": "الأعضاء والأدوار والتطبيقات المرتبطة بهذه المجموعة. صفِّ بحسب من غيّر أو متى.",
+      "historyEmpty": "لم تُسجَّل تغييرات صلاحيات لهذه المجموعة بعد.",
+      "historyEmptyFiltered": "لا توجد تغييرات صلاحيات تطابق الفلاتر الحالية.",
+      "historyAdded_zero": "أُضيف ({{count}}):",
+      "historyAdded_one": "أُضيف ({{count}}):",
+      "historyAdded_two": "أُضيف ({{count}}):",
+      "historyAdded_few": "أُضيف ({{count}}):",
+      "historyAdded_many": "أُضيف ({{count}}):",
+      "historyAdded_other": "أُضيف ({{count}}):",
+      "historyRemoved_zero": "أُزيل ({{count}}):",
+      "historyRemoved_one": "أُزيل ({{count}}):",
+      "historyRemoved_two": "أُزيل ({{count}}):",
+      "historyRemoved_few": "أُزيل ({{count}}):",
+      "historyRemoved_many": "أُزيل ({{count}}):",
+      "historyRemoved_other": "أُزيل ({{count}}):",
+      "historyTotal_zero": "{{count}} عنصر بعد التغيير",
+      "historyTotal_one": "{{count}} عنصر بعد التغيير",
+      "historyTotal_two": "{{count}} عنصران بعد التغيير",
+      "historyTotal_few": "{{count}} عناصر بعد التغيير",
+      "historyTotal_many": "{{count}} عنصراً بعد التغيير",
+      "historyTotal_other": "{{count}} عنصر بعد التغيير",
+      "history": {
+        "kind": {
+          "users": "المستخدمون",
+          "roles": "الأدوار",
+          "apps": "التطبيقات"
+        }
       }
     },
     "audit": {