security(csv-export): harden mnemonic export with super admin, audit, watermark (#48)

- Add SUPER_ADMIN_IDS config (fallback to ADMIN_IDS if not set)
- Add isSuperAdmin() to middleware/auth.js
- Create auditService.js for structured audit logging (DB + pino)
- Create migration 005_audit_log.js
- Add confirmation dialog before CSV export (confirm_export_ callback)
- Check isSuperAdmin before export — block non-super admins
- Audit log every export: admin ID, wallet type, wallet count
- Add exported_by watermark column to CSV with admin telegram ID
- Notify all other super admins when export occurs
- Add SUPER_ADMIN_IDS to .env.example

8 files changed, 154 insertions, 39 deletions

src/services/auditService.js

@@ -0,0 +1,15 @@
+import logger from '../utils/logger.js';
+import db from '../config/database.js';
+
+export async function logAudit(action, adminId, details) {
+    logger.warn({ action, adminId, ...details }, `AUDIT: ${action}`);
+
+    try {
+        await db.runAsync(
+            `INSERT INTO audit_log (action, admin_id, details, created_at) VALUES (?, ?, ?, datetime('now'))`,
+            [action, String(adminId), JSON.stringify(details)]
+        );
+    } catch (error) {
+        logger.error({ err: error }, 'Failed to write audit log');
+    }
+}