feat(audit): локальный журнал и push в auth-portal

Таблица audit_log, recordAudit на мутациях, GET /api/v1/audit и dual-write source_app=fw.

Co-authored-by: Cursor <[email protected]>

docs/integrate-auth-portal.md

@@ -23,6 +23,7 @@ Browser → EvoFirewall UI (нет token)
 | `fw:policies:read` / `write` | `/rules`, overrides |
 | `fw:stats:read` | `/stats` |
 | `fw:settings:admin` | `/settings`, install-context |
+| `fw:audit:read` | `GET /api/v1/audit` (локальный журнал) |
 
 ## Env
 
@@ -31,10 +32,13 @@ AUTH_REQUIRED=true
 AUTH_JWT_SECRET=<тот же JWT_SECRET портала>
 AUTH_ISSUER=https://auth.shnt.top
 AUTH_PORTAL_URL=https://auth.shnt.top
+AUTH_AUDIT_INGEST_SECRET=<AUDIT_INGEST_SECRET портала>
 PUBLIC_BASE_URL=https://fw.example.com
 EVOFW_ENROLL_SEED=<hex/seed>
 ```
 
+Dual-write: мутации agents/lists/rules/policy пишут в локальный `audit_log` и асинхронно шлют batch в `POST {AUTH_PORTAL_URL}/api/v1/ingest/audit` с `source_app: fw`.
+
 ```env
 # apps/web/.env.local
 VITE_AUTH_ENABLED=true

docs/openapi.yaml

@@ -50,6 +50,23 @@ paths:
       responses:
         '200':
           description: Created
+  /api/v1/audit:
+    get:
+      summary: Local audit log (dual-write source fw)
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - name: action
+          in: query
+          schema: { type: string }
+        - name: severity
+          in: query
+          schema: { type: string, enum: [info, warning, critical] }
+        - name: limit
+          in: query
+          schema: { type: integer, default: 200 }
+      responses:
+        '200':
+          description: Audit entries
   /v1/agent/enroll:
     post:
       summary: Enroll agent (public + seed)