- Add supabase/ to .gitignore (local CLI config should not be committed)
- Create and apply migration 20260607000001_audit_log_worm.sql via CLI:
creates audit_log table with RLS enabled + INSERT/SELECT policies +
WORM policies that block UPDATE and DELETE on all rows
- Update CLAUDE.md compliance checklist: audit_log WORM marked PASS
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>