feat(core-cms): register audit-logs + wire GDPR audit erasure

The audit-logs collection was never registered (record() would throw),
bindAudit/createAuditErasureHook were unused, and DSR cascade-hard never
touched the audit trail (audit finding A6). core-cms now registers the
collection and wires a req-scoped afterDelete erasure hook on users;
bindAllProduction binds the audit log into consent/DSR; cascade-hard
pseudonymizes the subject's audit entries; the action select accepts
the full AuditAction enum so consent/DSR entries pass validation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/web-next/src/server/bind-production.ts

@@ -172,7 +172,12 @@ export async function bindAllProduction(): Promise<void> {
     config: resolvedConfig,
     auditLog,
   });
-  const dsrBinding = bindProductionDsr({ config: resolvedConfig, auditLog });
+  const dsrBinding = bindProductionDsr({
+    config: resolvedConfig,
+    auditLog,
+    // cascade-hard deletions pseudonymize the subject's audit trail (A6)
+    auditErasure: auditLog,
+  });
   complianceBindings = { consentFactory, dsrBinding, auditLog };
 
   const ctx: BindProductionContext = {