Audit log

Immutable security and configuration events (admin only). Fed by auth, config, and events services.