feat(ADM-018): completed feature

work/artifacts/F-028/documenter.md

@@ -0,0 +1,24 @@
+# Documenter — F-028 Security hardening
+
+## Summary
+Security module adds sliding-window rate limiter, persisted audit log and admin MFA enrollment. PostgreSQL remains the identity and audit store.
+
+## API
+
+| Route | Access | Result |
+|---|---|---|
+| GET /admin/mfa/status | admin | `{ mfaEnrolled: boolean }` |
+| POST /admin/mfa/enroll | admin | Sets `mfa_enrolled` true; writes audit row |
+| POST /admin/audit/log | admin | Writes a manual audit log entry |
+| GET /admin/rate-limit/check?key=… | admin | Returns rate limit decision |
+
+## Schema changes
+- `security_audit_log` (migration 021)
+- `identity_users.mfa_enrolled` boolean default false
+
+## Evidence
+- work/artifacts/F-028/architect.md
+- work/artifacts/F-028/implementer.md
+- work/artifacts/F-028/reviewer.json
+- work/artifacts/F-028/security.json
+- work/artifacts/F-028/qa.json