update: Add Global Search on Header, Add Global Audit log for all actions.

backend/shared/audit.py

@@ -43,6 +43,10 @@ async def log_action(
     """
     Insert one row into audit_log. Never raises — failures are silently swallowed
     so a logging error never disrupts the primary request.
+
+    Always commits its own mini-transaction. Callers that run inside a larger
+    transaction (e.g. staff service) should commit themselves after calling this;
+    the extra commit here is a no-op if the session is already clean.
     """
     try:
         entry = AuditLog(
@@ -57,12 +61,9 @@ async def log_action(
             meta=meta,
         )
         db.add(entry)
-        # Flush without committing — caller's transaction commits it atomically.
-        # If the caller hasn't started a transaction, flush still works; the
-        # session will auto-commit on the next explicit commit call.
-        await db.flush()
+        await db.commit()
     except Exception:
-        pass
+        await db.rollback()
 
 
 def diff(old: dict, new: dict) -> dict[str, dict]: