Database used to decode the PostgREST error body and hand it back as if it
were the written row, so writes to missing columns (PGRST204), bad types and
broken foreign keys came back truthy and the controller flashed success.
Every failed request is now recorded and logged; insert/update/rpc return
null on failure; Response::success, redirect-with-success and json refuse to
report success over a recorded write failure and show the database's reason.
Best-effort writes (audit trail, page-view counters, last login) go through
Database::soft() so they cannot fail the action they describe.

AuditLog had never written a row: staff ids broke the actor_id foreign key
to profiles, names broke the resource_id uuid, and details was double
encoded. Staff now go in admin_user_id and text ids in resource_ref
(El3ab migrations/2026-10-26-manager-columns.sql); the audit page shows the
admin's name and searches the text reference.

Staff type times in Cairo: the app now runs in Africa/Cairo and core/Time
converts typed times to UTC instants and back, DST included.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>