End-to-end audit trail and compliance verification

The claim_events table must be append-only: enforce immutability via a PostgreSQL trigger (BEFORE UPDATE OR DELETE RAISE EXCEPTION) in addition to RLS policies — defence in depth. Each event payload should be a JSONB column containing the full state snapshot at the time of transition, not just deltas, so the audit trail is self-contained. For the Bufdir compliance report: the required fields per activity are activity_type, peer_mentor_id, org_id, date, duration_minutes, and any expense amounts — verify all are present in the event payload JSONB. For accounting export: Xledger requires project_code, cost_centre, amount, currency (NOK), and voucher_date — map these from claim_events in the export query.

This task is the final quality gate for the entire epic and must be green before the epic is marked complete. The documented schema (/docs/audit-trail-schema.ts) becomes the contract for the Bufdir reporting pipeline built in a later epic.

End-to-end integration tests using flutter_test against a dedicated test Supabase project with seed data. Test lifecycle: (1) insert seed claim via service role, (2) invoke threshold evaluation Edge Function, (3) invoke approval decision Edge Function, (4) read claim_events and assert row count, ordering, and field completeness, (5) attempt DELETE on claim_events row and assert 403/RLS rejection, (6) run compliance export query and assert all required Bufdir fields present, (7) run accounting export query and assert Xledger-compatible columns. Use a beforeAll hook to seed and an afterAll hook to clean up test data. Document each assertion with a comment referencing the specific Bufdir or accounting requirement it satisfies.