Summary

• add BUZZ_AUDIT_ENABLED, defaulting to true
• when disabled, skip the dedicated audit database pool and make event/media audit producers no-ops
• expose buzz_audit_enabled as a 0/1 gauge and log the configured state
• document that the separate moderation_actions audit trail is unaffected

Validation

• bin/cargo test -p buzz-relay audit_logging -- --nocapture (2 passed)
• bin/cargo check -p buzz-relay --all-targets
• bin/cargo fmt --all -- --check
• full relay package: 692 passed, 23 ignored; one unrelated mesh-demo timeout (504 vs 200), reproduced alone
• live audit-off relay: readiness/health passed; 25/25 concurrent sends accepted and re-read; audit_log remained 21 → 21; channel get, search, and canvas worked
• live default-on control: gauge 1; event path grew audit_log 21 → 26
• invalid config control: process exited 1 naming BUZZ_AUDIT_ENABLED
• moderation independence control: moderation_actions remained writable with tamper-evident audit disabled

Red-team note

A live media upload reached the storage path but the shared local MinIO returned HTTP 503 SlowDownWrite; this prevented a clean upload assertion. The full relay package's media tests passed, and the source dependency sweep found only the event and media producers use audit_tx.