feat: propagate audit correlation ids

[seonghobae]

Summary

• accept an optional X-Correlation-ID UUID on assessment import, completion publication, credential issue, and credential revocation
• retain generated UUIDs when callers omit the header
• reject malformed correlation IDs with HTTP 400 before opening the write transaction
• extend the exact-head smoke path with fixed correlation IDs and an explicit propagation assertion
• document the correlation boundary and the remaining audit export/operational evidence gap

Evidence

• real PostgreSQL 18.4 API E2E using a NOSUPERUSER application role: policy count 16, four audit events, four caller-specified correlation IDs persisted, cross-tenant audit visibility 0, invalid correlation header 400, assessment retry returned the same ID
• cargo test --workspace --all-targets --locked
• cargo clippy --workspace --all-targets --locked -- -D warnings
• RUSTDOCFLAGS=-Dwarnings cargo doc --workspace --no-deps --locked
• cargo build --bin lms_api --locked
• cargo fmt --all -- --check
• actionlint
• git diff --check

Gate

This is stacked on PR #13 and remains unmerged product evidence until an independent current-head review and required Checks pass. Merge only after re-fetching exact head 9d6d33a and confirming protected rules.

[seonghobae]

Current-head review request for 9d6d33a. Please independently verify header parsing and 400 behavior, propagation into the PR13 audit rows, generated-ID fallback, and exact-head workflow assertions. This is a COMMENT only; no approval or protected-merge bypass is requested.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: d003fc4e-7d5b-41e7-b21b-c5ad82e0f20a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Current-head review request for c75ff72. Re-verify the exact-head diff, required Checks, tenant/security boundaries, and any valid review findings after the shared Rust component-install fix. COMMENT only; no approval or protected-merge bypass is requested.