feat(F-083): completed feature

project/src/app/build-app.ts

@@ -177,12 +177,26 @@ export async function buildApp(deps: BuildAppDeps = {}): Promise<FastifyInstance
     // Session resolution; created before identity registration so it can be passed
     // to identity's /auth/me route.
     const authenticate = createSessionAuthenticator(deps.pool);
+    const auditLogger = new AuditLogger(deps.pool as pg.Pool);
 
     await app.register(async (instance) => {
       await registerIdentityRoutes(instance, {
         pool: deps.pool as pg.Pool,
         cookieSecure: deps.cookieSecure,
         authenticate,
+        passwordReset: {
+          audit: (entry) => {
+            // Best-effort audit; never block the request on audit failures.
+            void auditLogger
+              .log({
+                actorId: entry.userId ?? null,
+                action: entry.action,
+                target: entry.email ?? entry.userId ?? 'unknown',
+                metadata: { ip: entry.ip ?? null },
+              })
+              .catch(() => undefined);
+          },
+        },
       });
     });
 
@@ -370,7 +384,6 @@ export async function buildApp(deps: BuildAppDeps = {}): Promise<FastifyInstance
     });
 
     const rateLimiter = new RateLimiter();
-    const auditLogger = new AuditLogger(deps.pool);
     await app.register(async (instance) => {
       const broadcaster = getLogBroadcaster();
       await registerSecurityRoutes(instance, {