[Story]: Streaming export to Splunk, Sentinel and generic webhook

## Summary
Build streaming export of audit events to Splunk (HEC), Microsoft Sentinel, and a generic authenticated webhook, so a customer's SOC can ingest lightbridge events into their existing SIEM.

## Intent / Source of truth
"SIEM-exportable" is the actual buyer requirement, not just "has an audit log"; a log a SOC can't pull into their tooling doesn't clear the bar. Part of [Epic] SIEM-exportable audit log.

## Scope
- [ ] Splunk HTTP Event Collector (HEC) export
- [ ] Microsoft Sentinel (Log Analytics / Data Collector API) export
- [ ] Generic signed-webhook export for other SIEMs
- [ ] Export configuration UI/API (endpoint, credentials, filter)
- [ ] Delivery-failure handling (retry/backoff, dead-letter visibility)

## Out of scope
- Building bespoke connectors for every possible SIEM (the generic webhook covers the long tail)

## Verification
Live test delivering a sample event set into a Splunk test instance and a Sentinel workspace, confirmed visible and correctly parsed; webhook delivery confirmed with signature verification.

## Risk assessment
Silent export failures (e.g. a SIEM-side outage) must not silently drop events — the dead-letter/retry path needs explicit test coverage, since a customer relying on this for compliance evidence can't tolerate silent gaps.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

No files, tests, or entry points are named. Start by locating the existing audit-event and configuration or delivery paths, then trace how a sample event could reach Splunk, Sentinel, and a signed webhook; done requires the listed integrations, retry and dead-letter behavior, configuration, and the stated live verification.

由索引模型根据 Issue 内容生成。