# Documenter — F-028 Security hardening

## Summary
Security module adds sliding-window rate limiter, persisted audit log and admin MFA enrollment. PostgreSQL remains the identity and audit store.

## API

| Route | Access | Result |
|---|---|---|
| GET /admin/mfa/status | admin | `{ mfaEnrolled: boolean }` |
| POST /admin/mfa/enroll | admin | Sets `mfa_enrolled` true; writes audit row |
| POST /admin/audit/log | admin | Writes a manual audit log entry |
| GET /admin/rate-limit/check?key=… | admin | Returns rate limit decision |

## Schema changes
- `security_audit_log` (migration 021)
- `identity_users.mfa_enrolled` boolean default false

## Evidence
- work/artifacts/F-028/architect.md
- work/artifacts/F-028/implementer.md
- work/artifacts/F-028/reviewer.json
- work/artifacts/F-028/security.json
- work/artifacts/F-028/qa.json