feat(httpapi): add local audit log with portal dual-write

Локальный audit_log (миграции pg/sqlite), GET /v1/audit, запись на CRUD и async push в auth-portal (source_app=bgp).

Co-authored-by: Cursor <[email protected]>

internal/httpapi/routes_audit_test.go

@@ -0,0 +1,52 @@
+package httpapi
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"evobgp/internal/store"
+)
+
+func TestHandleListAudit(t *testing.T) {
+	mem := store.NewMemory()
+	mem.SeedDemo()
+	tenant, _, _, _, _ := mem.DemoIDs()
+
+	srv, err := New(Options{SeedDemo: false, InsecureDev: true})
+	if err != nil {
+		t.Fatal(err)
+	}
+	srv.store = mem
+
+	_, err = mem.AppendAudit(store.AuditAppendInput{
+		TenantID: tenant,
+		Action:   "bgp.module.create",
+		Summary:  "Created module demo",
+		TargetID: "mod-x",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/v1/audit", nil)
+	req.Header.Set("Authorization", "Bearer dev")
+	rec := httptest.NewRecorder()
+	srv.Handler().ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("status=%d body=%s", rec.Code, rec.Body.String())
+	}
+	var body struct {
+		Items []map[string]any `json:"items"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &body); err != nil {
+		t.Fatal(err)
+	}
+	if len(body.Items) != 1 {
+		t.Fatalf("items=%d", len(body.Items))
+	}
+	if body.Items[0]["action"] != "bgp.module.create" {
+		t.Fatalf("action=%v", body.Items[0]["action"])
+	}
+}