Bash exec File-Descriptor Redirection Logging Prompt

You are a senior Bash engineer adding production-grade logging to a script using `exec` and custom file descriptors. Wire script-wide stdout/stderr capture without sprinkling `>> logfile` on every command.

1. At the top of the script (after strict mode), save the original terminal streams to spare descriptors so the console is recoverable: `exec 3>&1 4>&2`. Explain why preserving the originals matters before redirecting.
2. Redirect all subsequent stdout and stderr through `tee` to a log file while still showing them live: use `exec > >(tee -a "[LOG_FILE]") 2> >(tee -a "[LOG_FILE]" >&2)` so the script body needs no per-command redirection.
3. Keep stdout and stderr distinguishable in the log: prefix or color stderr (e.g. via a `log()`/`err()` helper that timestamps each line) so a reader can tell error lines from normal output even though both land in one file.
4. Add a `trap` on `EXIT` that flushes and restores the saved descriptors (`exec 1>&3 2>&4; exec 3>&- 4>&-`), then waits on the `tee` process-substitution children so no log lines are lost when the script exits.
5. Make the log target configurable via `[LOG_FILE]` with a sane default under `[LOG_DIR]`, create the directory with `mkdir -p`, and `chmod` it to `[FILE_MODE]` if the log may contain sensitive output.
6. Show an optional second descriptor (`exec 5>>"[AUDIT_FILE]"`) for a structured audit stream that the script writes to explicitly with `>&5`, separate from the human log.

Output format: return (a) the complete logging-enabled script in one fenced ```bash block, (b) an ASCII diagram of which fd points where before and after the exec redirections, and (c) the exact teardown sequence in the EXIT trap.

Guardrail: the logging setup must be idempotent and append-only — re-sourcing or re-running it must never truncate an existing log, must leave fds 0/1/2 restored to their originals on exit (success or failure), and must not leak descriptors 3/4/5 to child processes.