phase-6: the staff console, and a log that says who did what

Flow H, three screens behind a role check: find an account, work the
ingestion error queue, read and export the audit log. Superadmins can
change a role, never their own.

The error queue merges ingest errors and dead jobs into one table with a
cursor that pages both sources; only a job can be retried and only an
ingest row resolved, with a note that migration 003 gives it somewhere
to live.

writeAudit no longer defaults a missing subject to the actor, which had
been recording a user search as staff looking themselves up. Omitting
the subject still means acting on yourself; null now means the action
has no subject, which is what a search, a retry and an export are.

Reading the log is not audited. Exporting it is: a copy leaving the
building is a different act from looking.

e2e/global-setup.ts asks for every screen once before the suite starts,
so a dev server's first-request compile is paid before the first test
rather than by it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

e2e/global-setup.ts

@@ -0,0 +1,46 @@
+import { request } from '@playwright/test';
+
+/**
+ * Asks for every screen once before the suite starts.
+ *
+ * Against `pnpm dev` a route is compiled the first time it is requested, and whichever test
+ * happens to be first pays for it: a sign in navigation runs past the five seconds
+ * Playwright waits by default and fails for a reason that has nothing to do with the
+ * product. Against a built stack these are cheap 200s and 307s.
+ */
+const ROUTES = [
+  '/es',
+  '/en',
+  '/es/login',
+  '/es/registro',
+  '/es/verificar',
+  '/es/inicio',
+  '/es/bandeja',
+  '/es/comprobantes',
+  '/es/comprobantes/nuevo',
+  '/es/declaraciones',
+  '/es/vencimientos',
+  '/es/escanear',
+  '/es/perfil',
+  '/es/configuracion',
+  '/es/consentimiento',
+  '/es/usuarios',
+  '/es/errores',
+  '/es/auditoria',
+  '/en/login',
+];
+
+export default async function globalSetup(): Promise<void> {
+  const baseURL = process.env['E2E_BASE_URL'] ?? 'http://localhost:3005';
+  const context = await request.newContext({ baseURL });
+  try {
+    for (const route of ROUTES) {
+      // A redirect to sign in is a compiled route, which is all this is after.
+      await context
+        .get(route, { failOnStatusCode: false, timeout: 120_000 })
+        .catch(() => undefined);
+    }
+  } finally {
+    await context.dispose();
+  }
+}