feat(audit): локальный журнал и push в auth-portal

Таблица audit_log, recordAudit на мутациях, GET /api/v1/audit и dual-write source_app=fw.

Co-authored-by: Cursor <[email protected]>

packages/shared/src/permissions.ts

@@ -35,7 +35,11 @@ export function permissionForRequest(
   if (path.startsWith('/api/v1/lists')) {
     return write ? 'fw:lists:write' : 'fw:lists:read'
   }
-  if (path.startsWith('/api/v1/rules') || path.startsWith('/api/v1/policies')) {
+  if (
+    path.startsWith('/api/v1/rules') ||
+    path.startsWith('/api/v1/policies') ||
+    path.startsWith('/api/v1/policy-sets')
+  ) {
     return write ? 'fw:policies:write' : 'fw:policies:read'
   }
   if (path.startsWith('/api/v1/stats') || path.startsWith('/api/v1/dashboard')) {
@@ -44,6 +48,9 @@ export function permissionForRequest(
   if (path.startsWith('/api/v1/settings') || path.startsWith('/api/v1/install-context')) {
     return write ? 'fw:settings:admin' : 'fw:settings:read'
   }
+  if (path.startsWith('/api/v1/audit')) {
+    return 'fw:audit:read'
+  }
   return null
 }