feat(data-safety): scheduled DB backups + audit trail + verified actor attribution

- db-backup sidecar: pg_dump -Fc of procurement+casdoor every
  BACKUP_INTERVAL_SECONDS into BACKUP_DIR, retention via BACKUP_KEEP_DAYS
- audit_log table (migration.sql + runtime ensure_audit_table) with
  model + transactional helper (utils/audit.record) — wired into user
  create/role-change and inventory transaction creation
- get_actor: quote_events.actor now stores the VERIFIED user's display
  name instead of the raw bearer token

backend/app/utils/security.py

@@ -1,14 +1,31 @@
-"""Placeholder auth: no middleware logic, only a header read for `actor` attribution."""
-from fastapi import Request
+"""Attribution for quote_events.actor — the VERIFIED user, not the raw token.
+
+Historically this stored the bearer token string verbatim (unverifiable and
+a token leak into the database). All routes that use it now sit behind the
+global JWT dependency, so the token is resolved to the authenticated user
+and the display name is recorded instead.
+"""
+from fastapi import Depends, Request
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.auth import get_optional_user
+from app.db.engine import get_db
 
 
-def get_actor(request: Request) -> str | None:
-    """Extract the bearer token (if any) to attribute quote_events.actor.
+async def get_actor(request: Request, db: AsyncSession = Depends(get_db)) -> str | None:
+    """Resolve the caller's display name from the Casdoor Bearer token."""
+    ctx = await get_optional_user(request, db)
+    if ctx is not None:
+        return ctx.display_name
+    # Dev-mode header fallback (only active when DEV_LOGIN_ENABLED) carries
+    # the name in X-User-Name / X-User-Name-B64 — keep attribution useful.
+    name = request.headers.get("x-user-name")
+    import base64
 
-    This is the reserved placeholder from the contract — no authentication
-    or authorization is enforced yet.
-    """
-    auth = request.headers.get("Authorization")
-    if auth and auth.lower().startswith("bearer "):
-        return auth[7:].strip() or None
-    return None
+    b64 = request.headers.get("x-user-name-b64")
+    if b64:
+        try:
+            name = base64.b64decode(b64.encode()).decode("utf-8")
+        except Exception:
+            pass
+    return name