feat: Backend Scaling Part 49 — Audit Integrity, Per-Tenant Rate Limits & Resource Quotas

[Jaydbrown]

Summary

Closes #374.

This PR implements the three pillars described in the issue:

• Tamper-evident audit log chain — row_hash + chain_hash columns on api_audit_logs, populated by a pgcrypto trigger on every INSERT; a second trigger denies all UPDATE/DELETE; a nightly scheduled job walks the chain and emits a structured alert on any broken link.
• Per-tenant rate-limit overrides with circuit breaker — operators store custom requests_per_minute / burst_size per organisation in tenant_configurations; Redis caches them for 5 minutes. The circuit breaker automatically halves effective limits when an org's error rate exceeds 20 % in a 60-second rolling window.
• Tenant resource quotas — max_employees, max_monthly_transactions, max_storage_mb columns on organization_settings; enforced before every employee/transaction INSERT; 80 % threshold warnings emitted as structured logs; daily snapshots stored in tenant_usage_snapshots with a 24-hour scheduled job.

Files changed

Path	Change
backend/src/db/migrations/024_audit_integrity_and_quotas.sql	New migration
backend/src/services/auditIntegrityService.ts	New — hash-chain verification
backend/src/services/tenantQuotaService.ts	New — quota enforcement + snapshots
backend/src/services/tenantRateLimitService.ts	New — per-org overrides + circuit breaker
backend/src/middleware/requireAdminJustification.ts	New — x-admin-reason gate
backend/src/middleware/tenantQuotaMiddleware.ts	New — quotaGuard() factory
backend/src/routes/adminRoutes.ts	New — 6 platform-admin endpoints
backend/src/routes/tenantUsageRoutes.ts	New — self-service quota + snapshot endpoints
backend/src/jobs/part49Jobs.ts	New — daily snapshot + nightly integrity jobs
backend/src/app.ts	Mount /api/admin and /api/usage
backend/src/index.ts	Register Part-49 jobs on startup
backend/src/services/rateLimitService.ts	Pass tenant overrides + circuit-breaker state
backend/src/middleware/advancedRateLimiting.ts	Forward tenantId to checkRateLimit
backend/src/routes/employeeRoutes.ts	Add quotaGuard('employees') middleware
backend/src/services/tenantConfigService.ts	Add rate-limit override helpers
backend/src/middleware/enhancedTenantIsolation.ts	Add logTenantAccess fire-and-forget
docs/BACKEND_SCALING_PART_49.md	Implementation reference
backend/src/__tests__/backendScalingPart49.test.ts	Hash-chain + quota error tests
backend/src/middleware/__tests__/requireAdminJustification.test.ts	Middleware unit tests
backend/src/services/__tests__/tenantQuotaService.test.ts	Quota service unit tests

Test plan

• Run npm test — all three new test files pass with DB pool mocked
• Apply migration 024_audit_integrity_and_quotas.sql to staging DB and verify triggers fire
• POST a new employee when the org is at its max_employees limit → expect 429 with X-Quota-Resource: employees
• Call any GET /api/admin/tenants/:orgId/rate-limits without x-admin-reason → expect 403
• Call the same endpoint with a valid justification → expect 200 and a row in platform_admin_access_logs
• Directly UPDATE a row in api_audit_logs → expect ERROR: audit log records are immutable
• Run GET /api/admin/audit/integrity with a tampered chain_hash row → expect a non-null firstBrokenLink in the response
• Confirm scheduleDailyUsageSnapshots and scheduleNightlyIntegrityCheck log their first run on server start