feat(httpapi): add local audit log with portal dual-write

Локальный audit_log (миграции pg/sqlite), GET /v1/audit, запись на CRUD и async push в auth-portal (source_app=bgp).

Co-authored-by: Cursor <[email protected]>

internal/store/memory_audit_test.go

@@ -0,0 +1,70 @@
+package store
+
+import "testing"
+
+func TestMemoryAppendAndListAudit(t *testing.T) {
+	m := NewMemory()
+	tenantA := "tenant-a"
+	tenantB := "tenant-b"
+
+	entry, err := m.AppendAudit(AuditAppendInput{
+		TenantID: tenantA,
+		Action:   "bgp.module.create",
+		Summary:  "Created module test",
+		TargetID: "mod-1",
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if entry == nil || entry.EventID == "" || entry.SourceApp != AuditSourceAppBGP {
+		t.Fatalf("unexpected entry: %+v", entry)
+	}
+
+	if _, err := m.AppendAudit(AuditAppendInput{
+		TenantID: tenantB,
+		Action:   "bgp.peer.delete",
+		Summary:  "Deleted peer",
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	items, _, hasMore, err := m.ListAudit(tenantA, "", 10, AuditListFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(items) != 1 || hasMore {
+		t.Fatalf("items=%d hasMore=%v", len(items), hasMore)
+	}
+	if items[0].Action != "bgp.module.create" {
+		t.Fatalf("action=%s", items[0].Action)
+	}
+
+	filtered, _, _, err := m.ListAudit(tenantA, "", 10, AuditListFilter{Action: "bgp.peer.delete"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(filtered) != 0 {
+		t.Fatalf("expected empty filter result, got %d", len(filtered))
+	}
+
+	if err := m.MarkAuditPortalPushed(entry.ID); err != nil {
+		t.Fatal(err)
+	}
+	items2, _, _, err := m.ListAudit(tenantA, "", 10, AuditListFilter{})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if items2[0].PortalPushedAt == nil {
+		t.Fatal("expected portal_pushed_at")
+	}
+}
+
+func TestMemoryAppendAuditValidation(t *testing.T) {
+	m := NewMemory()
+	if _, err := m.AppendAudit(AuditAppendInput{}); err != ErrInvalidInput {
+		t.Fatalf("err=%v", err)
+	}
+	if _, err := m.AppendAudit(AuditAppendInput{TenantID: "t", Action: "x", Summary: "s", Severity: "bad"}); err != ErrInvalidInput {
+		t.Fatalf("err=%v", err)
+	}
+}