Block a user
Remove unused
thiserror dependency from db crate (or land db::Error)
Add pagination to audit history_for before exposing it via the API
Extend the audit log to cover auth/security events
Run the app under a non-owner DB role (INSERT/SELECT only on audit_log)
Foundation follow-up cleanups
Decide OpenAPI schema strategy for domain newtypes (keep
domain I/O-free)
Make database connection pool size configurable
Add graceful shutdown to the HTTP server