docs(audit): record parafering audit umbrella rule (closes #406)

[rubenvdlinde]

Implements migrate-parafering-to-or-audit — adoption-only scope per investigation.

Investigation finding

The spec assumed procest had a ParaferingAuditListener + ParaferingAuditAppendOnlyValidator + paraferingAuditEntry schema. None exist. The Listener dir contains only DeepLinkRegistrationListener + KpiCacheInvalidationListener, and Application.php has no audit-listener registrations.

Parafering audit today lives as an in-object auditTrail array on the voorstel inside ParaferingService. The spec's framing doesn't match the code.

What this PR does

Records the umbrella rule in the spec so any future parafering-audit work routes through OR's AuditTrailMapper::createAuditTrailEntry() per ADR-022. The in-object array migration is a follow-up — it needs concurrent reader updates in views + a controller-side ObjectEntity resolution step that the current ParaferingService array-only API doesn't provide.

Scope adjustment documented inline in tasks.md.

Closes #406.

[github-actions]

Quality Report — ConductionNL/procest @ 02eff2e

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	❌
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		❌
stylelint		❌
composer			✅	✅ 100/100
npm			✅	✅ 419/419
PHPUnit					⏭️
Newman					⏭️
Playwright					❌

Spec coverage: 5% (21 tests / 456 specs)

---

Quality workflow — 2026-05-11 22:00 UTC

Download the full PDF report from the workflow artifacts.

[WilcoLouwerse]

🔴 Blockers

• 🔴 Tasks describe a listener file that the investigation block confirms does not exist

🟡 Concerns

• 🟡 Typo 'paraffeerstapId' (double f) propagated into spec and tasks
• 🟡 P-1 and P-2 tasks instruct injecting AuditTrailMapper into a listener that the investigation confirms does not yet exist

🟢 Minor

• 🟢 Audit chain verify endpoint path not cited in referenced OR spec

[rubenvdlinde]

Auto-closed in error by a force-push bug in the quality-cleanup harness. Reopened as #495 with the same branch and content.