Audit log (admin Activity list) and passkey recovery codes

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

backup.js

@@ -2,8 +2,9 @@
 // Treat the file like a password: it contains the session secret and encrypted sign-in tokens.
 const { spawn } = require('child_process');
 const path = require('path');
+const audit = require('./audit');
 const DATA_DIR = path.resolve(process.env.DATA_DIR || path.join(__dirname, 'data'));
-function handle(req, res) {
+function handle(req, res, who) {
   if (req.method !== 'GET') { res.writeHead(405); return res.end(); }
   const name = 'nehub-backup-' + new Date().toISOString().slice(0, 10) + '.tar.gz';
   const tar = spawn('tar', ['-czf', '-', '--exclude=./lyrics', '--exclude=*.tmp', '-C', DATA_DIR, '.'], { stdio: ['ignore', 'pipe', 'pipe'] });
@@ -12,6 +13,6 @@ function handle(req, res) {
   res.writeHead(200, { 'content-type': 'application/gzip', 'content-disposition': `attachment; filename="${name}"`, 'cache-control': 'no-store' });
   tar.stdout.pipe(res);
   res.on('close', () => tar.kill());
-  console.log('[backup] downloaded');
+  audit.log('backup downloaded', { who: who || '' }, req);
 }
 module.exports = { handle };