[Admin] Auditing cancellations

Every cancellation — member-initiated or admin-initiated — writes an entry to the `membership-package-history` collection. The log is append-only: no one (including platform admins via the UI) can edit or delete entries.

What's recorded for each cancellation: - Who cancelled (member uid or admin uid) - Their name and when - The membership id, tier/plan id, organization id - The effective end date - Whether the member was grandfathered (notice period snapshotted at signup) or used the current policy - Any reason the admin supplied (optional)

What's recorded for each policy change: - Who changed the policy (admin uid + name) - Before/after notice period values - Timestamp and optional reason

Viewing the log: - Per-package: click the History panel on any tier/plan card in your admin view. Shows all actions on that specific package. - Organisation-wide: use the Scheduled changes dashboard widget above the tier/plan list — it spans every package.

Compliance uses: - Proof of disclosure at signup (the `cancellationPolicyAcknowledgedAt` timestamp on the membership doc). - Proof of notice at cancel time (the history entry + the computed `effectiveDate`). - Proof of policy version (the `cancellationPolicyAcknowledgedVersion` integer increments when we refine the policy text).

Exporting: History entries can be exported via the backend CF `getMembershipPackageHistory` (admin-only callable). The current UI shows the most recent 50 entries; for compliance exports, contact support for a full dump.