<div class="audit-page">
  <header>
    <h1>Audit &amp; Security</h1>
    <p>Role changes, sensitive actions, login/security events, exports. Real role model does not exist yet - see docs/backend/TRACK-S-SECURITY-RBAC-CONTRACT.md. Today every authenticated admin has full access regardless of role.</p>
  </header>

  @if (facade.events().length === 0 && !facade.loading()) {
    <app-empty-state title="No audit events yet" description="Nothing to show until a real backend logs actions here." />
  } @else {
    <ul>
      @for (e of facade.events(); track e.id) {
        <li>{{ e.occurredAt }} - {{ e.actor }} - {{ e.action }} ({{ e.entityType }}:{{ e.entityId }})</li>
      }
    </ul>
  }
</div>
