Audit database migrations.
NIST AU-11: Audit records must not be lost during schema evolution. All migrations use ALTER TABLE (non-destructive) to preserve existing data.
v1 -> v2: Add userId column for GDPR data subject tracking.