feat(audit): локальный журнал и push в auth-portal

Таблица audit_log, recordAudit на CRUD, GET /api/v1/audit и dual-write source_app=cfdm.

Co-authored-by: Cursor <[email protected]>

apps/api/src/config.ts

@@ -21,6 +21,8 @@ export interface AppConfig {
   authRequired: boolean;
   authIssuer: string;
   authPortalUrl: string;
+  /** Bearer secret for POST {authPortalUrl}/api/v1/ingest/audit */
+  authAuditIngestSecret: string | null;
 }
 
 function boolEnv(v: string | undefined, fallback: boolean): boolean {
@@ -65,5 +67,8 @@ export function loadConfig(): AppConfig {
       process.env.VITE_AUTH_PORTAL_URL ??
       "http://localhost:5175"
     ).replace(/\/$/, ""),
+    authAuditIngestSecret:
+      process.env.AUTH_AUDIT_INGEST_SECRET?.trim() ||
+      (!isProd ? "dev-audit-ingest-secret" : null),
   };
 }