[Epic]: SIEM-exportable audit log

## Summary
Ship a structured, SIEM-exportable audit log covering policy changes, model access, admin actions and credential lifecycle — not just application request logs — with a documented retention policy and tamper-evidence.

## Intent / Source of truth
A CISO will not approve a tool their SOC cannot see into. GitHub's enterprise bar is a 180-day-retention audit log streamable to a SIEM. Source: 2026-08-13 enterprise-readiness research pass; no SIEM-exportable audit surface exists today.

## Scope
- [ ] Structured audit event schema covering policy/access/admin/credential events
- [ ] Streaming export to Splunk, Microsoft Sentinel, and a generic webhook sink
- [ ] Documented retention policy (minimum 180 days, configurable)
- [ ] Tamper-evidence mechanism

## Out of scope
- Real-time SIEM correlation rules (that's the customer's SOC tooling, not ours)
- Historical backfill of events predating this epic

## Verification
A policy change, a model-access event, an admin action and a credential-lifecycle event each produce a correctly schema'd audit record; the record is visible in a test Splunk/Sentinel instance within the documented export latency; a tampered record is detectably invalid.

## Risk assessment
An audit log that is itself mutable by admins defeats its purpose for compliance; tamper-evidence must cover admin-level access, not just external attackers.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

No files, tests, or code entry points are named. Start by mapping the existing audit-event and export surfaces in the Rust auth service, then define the schema, retention, three export targets, and tamper-evidence boundaries from the stated scope. Done means the four event categories pass verification, exports reach the specified sinks within documented latency, and tampering is detectable.

由索引模型根据 Issue 内容生成。