Guides image + draft gating, audit retention, ADR-015 gate, backup credential redaction

shopdb/core/models/user.py

@@ -62,6 +62,9 @@ class Permission(db.Model):
         ('users.delete', 'Delete users', 'admin'),
         # Audit
         ('audit.view', 'View audit logs', 'admin'),
+        # Deliberately separate from audit.view: reading the log and destroying
+        # history are different acts, and many people need only the first.
+        ('audit.purge', 'Delete audit log entries past the retention period', 'admin'),
         # API tokens
         ('apitokens.create', 'Create and manage API tokens', 'apitokens'),
         # Collector service tokens. A token scoped to ONLY this permission is a