CC1 R4-A3 — wire audit_log() into enrich /apply + helper available to all routers

- enrich_apply now imports audit_seal_router.audit_log and writes a sys_audit
  row after every successful UPDATE: action='enrich.apply', target_type=kind,
  target_id=eid, payload={applied: {...}, sources: [...]}, user from headers.
- Other modules (cc2 users, cc4 invoices/putni_nalozi, cc5 clanarine/lijecnicki/
  obrasci) can call the same helper:
      from audit_seal_router import audit_log
      audit_log(action='users.update', target_type='users', target_id=u['id'],
                payload={'changed':[...]}, user_email=actor)
- Verified: real apply on klub 4528 produced sys_audit id 102.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

routers/enrich_router.py

@@ -739,7 +739,8 @@ def _apply_to_db(kind: str, eid: int, fields: dict, sources: list, user_email: O
 @router.post("/enrich/{kind}/{eid}/apply")
 def enrich_apply(kind: str, eid: int,
                  body: dict = Body(default=None),
-                 x_user_email: Optional[str] = Header(default=None)):
+                 x_user_email: Optional[str] = Header(default=None),
+                 x_user_id:    Optional[int] = Header(default=None)):
     body = body or {}
     fields  = body.get('fields')
     sources = body.get('sources')
@@ -751,6 +752,21 @@ def enrich_apply(kind: str, eid: int,
         fields  = res['proposed']
         sources = res['sources']
     out = _apply_to_db(kind, eid, fields or {}, sources or [], x_user_email)
+    # R4-A3: write to pgz_sport.sys_audit so the audit page sees enrichment events
+    try:
+        from audit_seal_router import audit_log as _audit_log
+        if out.get('applied'):
+            _audit_log(
+                action='enrich.apply',
+                target_type=kind,
+                target_id=eid,
+                payload={'applied': out.get('applied'),
+                         'sources': [s.get('url') for s in (sources or []) if isinstance(s, dict)]},
+                user_id=x_user_id,
+                user_email=x_user_email,
+            )
+    except Exception:
+        pass
     return {'kind': kind, 'id': eid, **out}