[Story]: Structured audit event schema

## Summary
Define and implement the structured audit event schema covering policy changes, model access, admin actions and credential lifecycle events.

## Intent / Source of truth
Every downstream story (export, retention, tamper-evidence) depends on a consistent event schema existing first. Part of [Epic] SIEM-exportable audit log.

## Scope
- [ ] Event schema (actor, action, target, timestamp, source IP, org-tree context, before/after where applicable)
- [ ] Event emission wired into policy-change, model-access, admin-action and credential-lifecycle code paths
- [ ] Schema versioning strategy

## Out of scope
- Export connectors (separate story)

## Verification
Every in-scope action type (policy change, model access, admin action, credential create/revoke) produces exactly one correctly-shaped audit event, verified by integration tests.

## Risk assessment
Missing an event type at this stage means a silent audit gap discovered only during a customer's own SOC review; enumerate the action inventory carefully against the epic's four categories.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.