feat(audit): platform-tools atualizado (12f26fd) e registo de auditoria ligado

- shared/platform-tools: ea3616a → 12f26fd (27 commits). Traz o módulo de
  audit (f761d99, o pin da frota), «manter sessão iniciada», o registo de
  segurança da frota (o gancho que o login já tinha passa a funcionar) e a
  correção do IP do cliente encontrada nesta auditoria (último X-Forwarded-For
  / X-Real-IP), promovida ao partilhado. client_ip() da app delega nele.
- config/functions_audit.php: audit() sobre platform_audit(); tabela
  audit_log criada no primeiro uso, segredos ocultados, nunca parte a ação.
- Registado: login, falha de login, bloqueio por excesso de tentativas,
  logout, pedidos de recuperação, mudança/definição de palavra-passe,
  registo e criação de utilizadores, convites, perfil (antes/depois), todas
  as definições (db_update_setting, com valor anterior), cada passo da
  lixeira (apagar, restaurar, eliminar de vez) e ações nas mensagens.
- Sistema → Auditoria (views/sysadmin/audit.php), só sysadmin.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

shared/platform-tools/PHILOSOPHY.md

@@ -72,6 +72,22 @@ The corollary: **a site must not reimplement something this submodule provides.*
 If the shared version is wrong for one site, fix it here with a parameter, or
 say plainly in the site's own docs why it deviates.
 
+**The site declares; the shared code does not guess.** Each site's
+`config/db.php` makes one `platform_connect()` call that states its PDO, base
+URL, environment, column map, roles, session and sysadmin guard. Before it,
+every tool probed for variants — a global `$pdo` or `App\Database`, a
+`base_url()` or a `getBaseUrl()` — and each new tool had to remember them all.
+The same call runs `platform_conformance()`: the database is compared with what
+the shared code expects, and a missing column that would switch a defence off
+without an error fails loudly in development and turns the hub card yellow in
+production (§7).
+
+**New tools reach every site without a file on the site.** The shared pages are
+served by one front controller (`public/platform.php?tool=…`) and the shared
+endpoints by another (`public/api/platform.php?endpoint=…`), both from closed
+route tables here. A per-page stub on each of seven sites was seven chances to
+forget one.
+
 Submodules have one sharp edge worth stating: `git pull` in a site advances the
 submodule *pointer* but leaves its working tree on the old commit, silently and
 with no error. Every deploy script therefore runs `git submodule update
@@ -127,7 +143,8 @@ Two things stay per-site, deliberately:
 
 - **The users table.** The columns genuinely differ — fotografia's users carry
   CalDAV credentials, silver's carry a guardian. The shared code adapts through
-  `auth_schema()` rather than demanding one shape, because renaming a column
+  the `schema` given to `platform_connect()` (`auth_schema()` underneath),
+  declaring only the columns that differ, rather than demanding one shape, because renaming a column
   with 147 references is a migration and adapting is a function call.
 
   The same map covers *what you sign in with*. Six sites match on `email`;
@@ -189,7 +206,9 @@ sized to its workload rather than copied between sites.
 
 Application code sits outside the document root: the web root is `public/`, and
 `shared/`, `config/` and `src/` are not reachable over HTTP. Anything that
-genuinely must be callable is a thin, explicit stub in `public/api/`.
+genuinely must be callable goes through the two front controllers or a thin,
+explicit stub in `public/api/` — and the front controllers only dispatch names
+from a closed list; they never include a path taken from the request.
 
 ## 9. Migrations are append-only