M1: implement operational core

Demo auth, seed import/reset, dashboard, vehicle/booking list+detail, audit trail. Backend: 19 tests passing, ruff clean. Frontend: React Router shell, typed API client, responsive pages. Verified end-to-end via curl and browser.

backend/app/services/audit.py

@@ -0,0 +1,40 @@
+from __future__ import annotations
+
+import uuid
+from datetime import UTC, datetime
+from typing import Any
+
+from sqlalchemy.orm import Session
+
+from app.models.audit import AuditEvent
+
+
+def record_audit_event(
+    db: Session,
+    *,
+    actor_type: str,
+    actor_label: str,
+    action: str,
+    entity_type: str,
+    actor_id: uuid.UUID | None = None,
+    entity_id: uuid.UUID | None = None,
+    correlation_id: uuid.UUID | None = None,
+    before: dict[str, Any] | None = None,
+    after: dict[str, Any] | None = None,
+    metadata: dict[str, Any] | None = None,
+) -> AuditEvent:
+    event = AuditEvent(
+        actor_type=actor_type,
+        actor_id=actor_id,
+        actor_label=actor_label,
+        action=action,
+        entity_type=entity_type,
+        entity_id=entity_id,
+        correlation_id=correlation_id or uuid.uuid4(),
+        before_json=before,
+        after_json=after,
+        metadata_json=metadata,
+        occurred_at=datetime.now(UTC),
+    )
+    db.add(event)
+    return event