feat(httpapi): add local audit log with portal dual-write

Локальный audit_log (миграции pg/sqlite), GET /v1/audit, запись на CRUD и async push в auth-portal (source_app=bgp).

Co-authored-by: Cursor <[email protected]>

internal/store/audit.go

@@ -0,0 +1,67 @@
+package store
+
+import (
+	"strings"
+	"time"
+)
+
+const (
+	AuditSourceAppBGP      = "bgp"
+	AuditTargetAppResource = "app_resource"
+	AuditSeverityInfo      = "info"
+	AuditSeverityWarning   = "warning"
+	AuditSeverityCritical  = "critical"
+)
+
+// AuditEntry is a persisted CRUD / settings audit row (local + portal ingest).
+type AuditEntry struct {
+	ID                string
+	TenantID          string
+	EventID           string
+	SourceApp         string
+	Action            string
+	Severity          string
+	ActorUserID       string
+	ActorEmail        string
+	ActorName         string
+	ActorAPIKeyPrefix string
+	TargetType        string
+	TargetID          string
+	Summary           string
+	Details           map[string]any
+	IP                string
+	CreatedAt         time.Time
+	PortalPushedAt    *time.Time
+}
+
+// AuditAppendInput is input for AppendAudit.
+type AuditAppendInput struct {
+	TenantID          string
+	Action            string
+	Severity          string
+	ActorUserID       string
+	ActorEmail        string
+	ActorName         string
+	ActorAPIKeyPrefix string
+	TargetType        string
+	TargetID          string
+	Summary           string
+	Details           map[string]any
+	IP                string
+}
+
+// AuditListFilter optional query filters for ListAudit.
+type AuditListFilter struct {
+	Action   string
+	Severity string
+}
+
+// ValidAuditSeverity reports whether s is an allowed severity.
+func ValidAuditSeverity(s string) bool {
+	switch strings.ToLower(strings.TrimSpace(s)) {
+	case AuditSeverityInfo, AuditSeverityWarning, AuditSeverityCritical:
+		return true
+	default:
+		return false
+	}
+}