feat(audit): локальный журнал и push в auth-portal

Таблица audit_log, recordAudit на мутациях, GET /api/v1/audit и dual-write source_app=fw.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/app.ts

@@ -14,6 +14,7 @@ import dbPlugin from './plugins/db.js'
 import errorHandlerPlugin from './plugins/error-handler.js'
 import { healthRoutes } from './routes/health.js'
 import { controlRoutes } from './routes/control.js'
+import { auditRoutes } from './routes/audit.js'
 import { agentRoutes } from './routes/agent.js'
 import { refreshAllLists } from './services/lists/refresh.js'
 import { repos } from '@evofw/db'
@@ -62,6 +63,7 @@ export async function buildApp(opts: BuildAppOptions = {}) {
     async (protectedApi) => {
       protectedApi.addHook('onRequest', app.requireAuth)
       await protectedApi.register(controlRoutes, { config })
+      await protectedApi.register(auditRoutes)
     },
     { prefix: '/api/v1' },
   )