d0cec54f9b
`registerAuditedModels()` (#4781) declared four models. The Settings page has seven tabs, and a sweep found Groups and Agents fully audited beside Priorities, Statuses, Projects, Email connections and Automation writing nothing at all — zero rows for any of their routes in the whole store. `PriorityLevel`, `TicketStatus` and `TicketingProject` are now declared, in the shape the existing four use. `color` and `description` are left out of all three for the reason the group's colour is. The Email tab could not be declared. Its mailbox host, port, username and PASSWORD live in one `config` JSON column, and `Audit::redact()` masks by top-level field name only — `normalize()` walks into an array and never redacts inside one — so declaring `config` would write the school's mailbox credential in clear into a table read under `logs.view` alone. Declaring only the scalar columns is the other trap: an update that moved no declared field records nothing, so re-pointing a connection at a different mailbox would still have been silent, which is the write the card was filed about. `EmailConnectionAudit` is therefore the one writer for that tab, flattening `config` into `config.host` / `config.password` keys — the spelling the central redaction masks — and masking the secret at source as well, so the credential never reaches the logger at all. `EmailConnectionAuditLabels` declares the label with no observer, the shape `PulseAuditLabels` and `GroupAuditLabels` use, so those rows are not doubled. The Automation tab writes shell `Setting` rows, which no declaration here could reach; `AutomationSettingsAudit` records one row per save naming only what moved. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>