P3-02-03-04: audit log, batch ops, transactions

P3-02: audit-log.entity + service, manual logging in controller
  (startSession, submitAnswer, deleteSession, review, forceEnd)
P3-03: POST batch-delete, POST batch-export endpoints + service methods
P3-04: DataSource.transaction for deleteSession + reviewAssessment,
  graph state cleanup on session delete

server/src/assessment/services/audit-log.service.ts

@@ -0,0 +1,37 @@
+import { Injectable, Logger } from '@nestjs/common';
+import { InjectRepository } from '@nestjs/typeorm';
+import { Repository } from 'typeorm';
+import { AuditLog } from '../entities/audit-log.entity';
+
+@Injectable()
+export class AuditLogService {
+  private readonly logger = new Logger(AuditLogService.name);
+
+  constructor(
+    @InjectRepository(AuditLog)
+    private auditLogRepository: Repository<AuditLog>,
+  ) {}
+
+  async log(params: {
+    userId: string;
+    tenantId?: string;
+    action: string;
+    resourceType: string;
+    resourceId?: string;
+    details?: any;
+  }): Promise<void> {
+    try {
+      const entry = this.auditLogRepository.create({
+        userId: params.userId,
+        tenantId: params.tenantId,
+        action: params.action,
+        resourceType: params.resourceType,
+        resourceId: params.resourceId,
+        details: params.details,
+      });
+      await this.auditLogRepository.insert(entry);
+    } catch (error) {
+      this.logger.error(`Failed to write audit log: ${error.message}`);
+    }
+  }
+}