fix(worker): populate forwarder_sent.audit_log_id for UUID-shaped audit_ids (mig 072)

Companion to api mig 072 (forwarder_sent.audit_log_id UUID FK column).

markSent now includes audit_log_id in the INSERT column list and populates
it via an inline CASE expression:

  CASE WHEN $1 ~* '^[0-9a-f]{8}-...-[0-9a-f]{12}$'
       THEN $1::uuid
       ELSE NULL
  END

This means:
- Real UUID audit_ids (post-mig-063 rows from audit_log-backed emitters)
  → audit_log_id set; the orphan-reconciler can JOIN on the typed UUID column
  instead of scanning with a regex over TEXT.
- Placeholder IDs ("reminder-<resource_id>-<stage>", "provider-<grace_id>")
  → audit_log_id stays NULL; no behaviour change for those legacy emitters.

Test update: TestForwarder_LedgerClaim_AllColumnsRoundtripThroughInsert
updated to match the new column list + CASE expression in the INSERT regex.

Author: mastermanas805

internal/jobs/event_email_forwarder.go

@@ -249,10 +249,21 @@ func (l *sqlSentLedger) isSent(ctx context.Context, auditID string) (bool, error
 // answer "what happened to email X" without log-spelunking. The caller
 // MUST pre-mask the recipient (see ledgerClaim doc).
 func (l *sqlSentLedger) markSent(ctx context.Context, c ledgerClaim) (bool, error) {
+	// audit_log_id is the real UUID FK companion to the soft-FK audit_id TEXT
+	// column (mig 072). Populate it when audit_id is UUID-shaped so the
+	// orphan-reconciler and team-deletion cascade can use a typed JOIN.
+	// Placeholder IDs ("reminder-<resource_id>-<stage>", "provider-<grace_id>")
+	// leave audit_log_id NULL — the SQL CASE never casts them.
 	res, err := l.db.ExecContext(ctx, `
 		INSERT INTO forwarder_sent
-			(audit_id, provider, provider_id, recipient, template_kind, classification)
-		VALUES ($1, $2, $3, $4, $5, $6)
+			(audit_id, provider, provider_id, recipient, template_kind, classification, audit_log_id)
+		VALUES (
+			$1, $2, $3, $4, $5, $6,
+			CASE WHEN $1 ~* '^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$'
+			     THEN $1::uuid
+			     ELSE NULL
+			END
+		)
 		ON CONFLICT (audit_id) DO NOTHING
 	`, c.AuditID, c.Provider, c.ProviderID, c.Recipient, c.TemplateKind, c.Classification)
 	if err != nil {

internal/jobs/event_email_forwarder_coverage_test.go

@@ -938,7 +938,11 @@ func TestEventForwarder_CursorWriteErr_AfterPermanent(t *testing.T) {
 func TestForwarder_LedgerClaim_AllColumnsRoundtripThroughInsert(t *testing.T) {
 	db, mock, _ := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherRegexp))
 	defer db.Close()
-	mock.ExpectExec(`INSERT INTO forwarder_sent\s*\(audit_id, provider, provider_id, recipient, template_kind, classification\)`).
+	// SQL now includes audit_log_id (mig 072): the CASE expression sets it to
+	// $1::uuid when audit_id is UUID-shaped, NULL otherwise. The regex matches
+	// the new column list and the CASE expression so this test catches any
+	// future column drift.
+	mock.ExpectExec(`INSERT INTO forwarder_sent\s*\(audit_id, provider, provider_id, recipient, template_kind, classification, audit_log_id\)`).
 		WithArgs("a1", providerNoneMissingRenderer, providerIDMissingRenderer, "a***@example.com", "anon.expiry_warning", ledgerClassPermanentDrop).
 		WillReturnResult(sqlmock.NewResult(0, 1))