feat(#15): session audit log domain, store, and instrumentation

src/GmRelay.Web/Services/SessionService.cs

@@ -202,6 +202,32 @@ public sealed class SessionService(
             new { GroupId = groupId })).ToList();
     }
 
+    public async Task LogSessionChangeAsync(Guid sessionId, long actorTelegramId, string actorName, string changeType, string? oldValue, string? newValue)
+    {
+        await using var conn = await dataSource.OpenConnectionAsync();
+        await conn.ExecuteAsync(
+            """
+            INSERT INTO session_audit_log (session_id, actor_telegram_id, actor_name, change_type, old_value, new_value)
+            VALUES (@SessionId, @ActorTelegramId, @ActorName, @ChangeType, @OldValue, @NewValue)
+            """,
+            new { SessionId = sessionId, ActorTelegramId = actorTelegramId, ActorName = actorName, ChangeType = changeType, OldValue = oldValue, NewValue = newValue });
+    }
+
+    public async Task<List<SessionAuditLogEntry>> GetSessionHistoryAsync(Guid sessionId)
+    {
+        await using var conn = await dataSource.OpenConnectionAsync();
+        var entries = await conn.QueryAsync<SessionAuditLogEntry>(
+            """
+            SELECT id, session_id AS SessionId, actor_telegram_id AS ActorTelegramId, actor_name AS ActorName,
+                   change_type AS ChangeType, old_value AS OldValue, new_value AS NewValue, changed_at AS ChangedAt
+            FROM session_audit_log
+            WHERE session_id = @SessionId
+            ORDER BY changed_at DESC
+            """,
+            new { SessionId = sessionId });
+        return entries.ToList();
+    }
+
     public async Task AddGroupCoGmAsync(
         Guid groupId,
         long ownerTelegramId,