chore: Integrate confirmation booking audit

[tomerqodo]

Benchmark PR from qodo-benchmark#714

---

Note

Introduces end-to-end booking audit context and events for confirmations and rejections.

• Audit context propagation: Passes actor and actionSource through confirmHandler, handleConfirmation, API v2 confirmBooking/declineBooking, magic link routes, and payment webhooks; TRPC bookings.confirm injects actor and WEBAPP source
• Audit events: Emits onBookingAccepted/onBulkBookingsAccepted from handleConfirmation and onBookingRejected/onBulkBookingsRejected from confirm.handler, including status transitions and optional rejection reason
• Action sources: Adds MAGIC_LINK to BookingAuditSource (DB + types) and validates sources; magic link endpoints now call confirmHandler with MAGIC_LINK
• App actor for webhooks: New getAppActor utility; handlePaymentSuccess now accepts an object incl. appSlug, derives actor, and calls handleConfirmation with WEBHOOK source; updates Alby/BTCPay/HitPay/PayPal/Stripe webhook handlers accordingly
• Booking-audit services: Adds queueBulkRejectedAudit to producer interface and tasker implementation; updates RejectedAuditActionService schema to use BookingStatusChangeSchema and simplified display
• Tests: Adds/updates route tests for magic links and verify-token, payment success tests for new signature, confirm handler tests covering accepted/rejected (single/bulk), and an integration test for accepted action
• Minor: export makeUserActor via platform libraries; non-functional formatting changes

^{Written by Cursor Bugbot for commit 1c943ca. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Incorrect oldStatus recorded for single booking acceptance

Medium Severity

For non-recurring bookings, the oldStatus is hardcoded to BookingStatus.ACCEPTED instead of using booking.status. Since the booking parameter includes the original status before confirmation, the audit data will incorrectly show { old: ACCEPTED, new: ACCEPTED } instead of the actual transition like { old: PENDING, new: ACCEPTED }.

 

[cursor]

Wrong status used for recurring booking rejection audit

Medium Severity

For recurring booking rejections, the code fetches updatedRecurringBookings after the status has already been changed to REJECTED, then uses that status as oldStatus. This results in audit data showing { old: REJECTED, new: REJECTED } instead of the correct { old: PENDING, new: REJECTED }. The code should use unconfirmedRecurringBookings which was fetched before the update.