feat(audit): локальный журнал и push в auth-portal

Таблица audit_log, recordAudit на CRUD, GET /api/v1/audit и dual-write source_app=cfdm.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/services/audit-portal-push.ts

@@ -0,0 +1,23 @@
+import { request } from "undici";
+import type { IngestAuditEvent } from "@cfdm/shared";
+
+export async function pushAuditEvents(
+  portalUrl: string,
+  secret: string,
+  events: IngestAuditEvent[],
+): Promise<void> {
+  const base = portalUrl.replace(/\/$/, "");
+  const res = await request(`${base}/api/v1/ingest/audit`, {
+    method: "POST",
+    headers: {
+      "content-type": "application/json",
+      authorization: `Bearer ${secret}`,
+    },
+    body: JSON.stringify({ events }),
+  });
+
+  if (res.statusCode >= 400) {
+    const body = await res.body.text();
+    throw new Error(`portal audit ingest ${res.statusCode}: ${body}`);
+  }
+}