[Epic]: SIEM-exportable audit log

## Summary
Ship a structured, SIEM-exportable audit log covering policy changes, model access, admin actions and credential lifecycle — not just application request logs — with a documented retention policy and tamper-evidence.

## Intent / Source of truth
A CISO will not approve a tool their SOC cannot see into. GitHub's enterprise bar is a 180-day-retention audit log streamable to a SIEM. Source: 2026-08-13 enterprise-readiness research pass; no SIEM-exportable audit surface exists today.

## Scope
- [ ] Structured audit event schema covering policy/access/admin/credential events
- [ ] Streaming export to Splunk, Microsoft Sentinel, and a generic webhook sink
- [ ] Documented retention policy (minimum 180 days, configurable)
- [ ] Tamper-evidence mechanism

## Out of scope
- Real-time SIEM correlation rules (that's the customer's SOC tooling, not ours)
- Historical backfill of events predating this epic

## Verification
A policy change, a model-access event, an admin action and a credential-lifecycle event each produce a correctly schema'd audit record; the record is visible in a test Splunk/Sentinel instance within the documented export latency; a tampered record is detectably invalid.

## Risk assessment
An audit log that is itself mutable by admins defeats its purpose for compliance; tamper-evidence must cover admin-level access, not just external attackers.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

No files, tests, or code entry points are named. Start by mapping the existing audit-event and export surfaces in the Rust auth service, then define the schema, retention, three export targets, and tamper-evidence boundaries from the stated scope. Done means the four event categories pass verification, exports reach the specified sinks within documented latency, and tampering is detectable.

Written by the indexing model from the issue text.