pub async fn record(db: &Db, entry: LogEntry<'_>) -> Result<()>
Write one row to the action log. Validates required fields before touching the DB so a broken audit pipeline becomes visible.