Refine audit trail requirements with access control and export constraints

[Copilot]

Stakeholder feedback clarified visibility, retention, and export requirements for the result entry audit trail feature.

Acceptance Criteria Changes

• Access control: Audit info visible only to users with tournament access (Organizers, Referees, Admins), not spectators
• Live Dashboard: Explicit exclusion for public viewers
• CSV exports: Audit fields excluded from export logic
• Search/filter: Scoped to privileged users only

Resolved Questions (4 of 6)

• ✅ Visibility: Tournament staff only, no spectators via Live Dashboard
• ✅ Retention: Same policy as other tournament data (DSGVO-compliant)
• ✅ CSV export: Explicitly excluded
• ✅ Username override: Not supported - actual user always recorded

Technical Notes Updated

• Frontend: Permission checks required before rendering audit UI, Live Dashboard exclusion
• Backend: API endpoints require permission checks, CSV export logic excludes audit fields
• Security: Strict separation between participants (no access) and staff (full access)

Remaining open questions: email notifications for changes, handling of auto-generated results.

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.