feat: enforce tenant content moderation

server/db/mysql/tenant_security_audit.go

@@ -36,6 +36,30 @@ func (a *adapter) TenantLoginAuditCreate(id t.TenantID, event *t.LoginAuditEvent
 	return err
 }
 
+func (a *adapter) TenantContentModerationLogCreate(id t.TenantID, event *t.ContentModerationLog) error {
+	tenantAdp, err := a.routedTenantAdapter(id)
+	if err != nil || event == nil || strings.TrimSpace(event.RequestID) == "" {
+		return t.ErrMalformed
+	}
+	if tenantAdp != a {
+		return tenantAdp.TenantContentModerationLogCreate(id, event)
+	}
+	labels, err := json.Marshal(event.RiskLabels)
+	if err != nil {
+		return err
+	}
+	var actorID any
+	if !event.ActorID.IsZero() {
+		actorID = decodeUID(event.ActorID)
+	}
+	_, err = a.db.Exec(`INSERT INTO im_content_moderation_logs
+		(request_id,scene,topic,seqid,actor_id,provider,provider_request_id,risk_level,risk_labels,action,content_hash,latency_ms,error_code,created_at)
+		VALUES(?,?,?,?,?,?,?,?,CAST(? AS JSON),?,?,?,?,?)`, event.RequestID, event.Scene, event.Topic, event.SeqID, actorID,
+		event.Provider, event.ProviderRequestID, event.RiskLevel, string(labels), event.Action, event.ContentHash,
+		event.LatencyMS, event.ErrorCode, event.CreatedAt)
+	return err
+}
+
 func (a *adapter) TenantLoginFailureCreate(id t.TenantID, event *t.LoginFailureEvent) error {
 	tenantAdp, err := a.routedTenantAdapter(id)
 	if err != nil || event == nil {