Add protected training content admin

backend/migrations/004_content_audit.sql

@@ -0,0 +1,17 @@
+-- Audit every administrative create/update/publish action on training content.
+-- Apply after 003_training_content.sql and after taking a database backup.
+
+CREATE TABLE training_content_audit (
+    id BIGINT UNSIGNED AUTO_INCREMENT PRIMARY KEY,
+    entity_type ENUM('exercise', 'plan') NOT NULL,
+    entity_uuid CHAR(36) NOT NULL,
+    action ENUM('create', 'update', 'publish', 'unpublish') NOT NULL,
+    previous_value JSON NULL,
+    new_value JSON NOT NULL,
+    actor_user_id INT NULL,
+    created_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    INDEX idx_content_audit_entity_time (entity_type, entity_uuid, created_at),
+    INDEX idx_content_audit_actor_time (actor_user_id, created_at),
+    CONSTRAINT fk_content_audit_actor FOREIGN KEY (actor_user_id)
+        REFERENCES users(id) ON DELETE SET NULL
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;