feat: audit log poin — catat pencatatan/penghapusan pelanggaran (sebelum/sesudah/delta, metadata snapshot, actor, IP) + halaman Riwayat Poin (filter, permission view-point-audit) + 4 feature test

app/Http/Controllers/Admin/PointAuditController.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\PointAuditLog;
+use Illuminate\Http\Request;
+use Illuminate\View\View;
+
+class PointAuditController extends Controller
+{
+    public function index(Request $request): View
+    {
+        $query = PointAuditLog::with(['student', 'actor']);
+
+        // Wali kelas murni: hanya siswa di kelasnya
+        if (auth()->user()->isScopedWaliKelas()) {
+            $query->whereHas('student', fn ($q) => $q->whereIn('class_id', auth()->user()->homeroomClassIds()));
+        }
+
+        $query->when($request->filled('search'), fn ($q) => $q->whereHas('student', fn ($qq) => $qq
+            ->where('full_name', 'like', "%{$request->search}%")
+            ->orWhere('nisn', 'like', "%{$request->search}%")));
+
+        $query->when($request->filled('action'), fn ($q) => $q->where('action', $request->action));
+        $query->when($request->filled('date_from'), fn ($q) => $q->whereDate('created_at', '>=', $request->date_from));
+        $query->when($request->filled('date_to'), fn ($q) => $q->whereDate('created_at', '<=', $request->date_to));
+
+        $logs = $query->orderByDesc('created_at')->paginate(25)->withQueryString();
+
+        $summary = [
+            'total' => PointAuditLog::count(),
+            'penambahan' => PointAuditLog::where('points_delta', '>', 0)->count(),
+            'pengurangan' => PointAuditLog::where('points_delta', '<', 0)->count(),
+        ];
+
+        return view('point-audit.index', compact('logs', 'summary'));
+    }
+}

app/Http/Controllers/ViolationController.php

@@ -272,6 +272,31 @@ class ViolationController extends Controller
 
     public function destroy(Violation $violation): RedirectResponse
     {
+        abort_unless(auth()->user()->canViewStudent($violation->student_id), 403);
+
+        // Audit log perubahan poin (penghapusan pelanggaran)
+        $student = $violation->student;
+        $before = $student->total_points; // termasuk pelanggaran yang akan dihapus
+        $after = max(0, $before - $violation->points);
+
+        \App\Models\PointAuditLog::log(
+            studentId: $violation->student_id,
+            action: \App\Models\PointAuditLog::ACTION_DELETED,
+            pointsBefore: $before,
+            pointsAfter: $after,
+            description: ($violation->violationType?->name ?? 'Pelanggaran').' (dihapus)',
+            metadata: [
+                'violation_date' => $violation->violation_date?->format('Y-m-d'),
+                'description' => $violation->description,
+                'sanction' => $violation->sanction,
+                'location' => $violation->location,
+                'points' => $violation->points,
+            ],
+            violationId: $violation->id,
+            actorId: auth()->id(),
+            ipAddress: request()->ip(),
+        );
+
         $violation->delete();
 
         return redirect()->route('violations.index')