Document the usage of Audit:Logger (#8284)

One of the DEV maintainers pointed out that our action logging mechanism
isn't documented anywhere. This add some context for that code!

docs/backend/audit-log.md

@@ -0,0 +1,45 @@
+---
+title: Audit Log
+---
+
+# Audit Log
+
+To help maintain accountability for users with elevated permissions the DEV
+application has a special model that records certain actions.
+
+For example, when a user with the `trusted` role creates a negative reaction on
+an article a record is created with certain information about that action.
+
+That record (which we call an `AuditLog`) looks something like this:
+
+```ruby
+#<AuditLog:0x00005629f019a490
+ id: 1,
+ category: "moderator.audit.log",
+ created_at: Thu, 07 May 2020 20:25:31 UTC +00:00,
+ data:
+  {"action"=>"create", "category"=>"vomit", "controller"=>"reactions", "reactable_id"=>"16", "reactable_type"=>"Article"},
+ roles: ["trusted"],
+ slug: "create",
+ updated_at: Thu, 07 May 2020 20:25:31 UTC +00:00,
+ user_id: 21>
+```
+
+You can see from this record that the user with an id of `21` created a vomit
+reaction on the article with an id of `16`. If that's not obvious to you from
+this object, don't worry, just take our word on it.
+
+You can find an example of `Audit::Logger` in action in
+`app/controllers/internal/reactions_controller.rb`:
+
+```ruby
+  after_action only: [:update] do
+    Audit::Logger.log(:moderator, current_user, params.dup)
+  end
+```
+
+This code creates a record to indicate that a someone modified a reaction from
+the internal controller.
+
+It's a good idea to add a similar `after_action` to any controller action that
+might benefit from increased transparency.

docs/backend/readme.md

@@ -1,6 +1,7 @@
 ---
 title: Backend Guide
 items:
+  - audit-log.md
   - authentication.md
   - auth-twitter.md
   - auth-github.md