[Story]: Auditor read-only role with enforcement tests

## Summary
Implement and test the auditor (read-only) role: full read access to policy, audit-log and configuration surfaces, with zero mutation rights anywhere in the platform.

## Intent / Source of truth
Compliance workflows specifically require a role that can review evidence without being able to alter it — this is a named, distinct requirement from the general RBAC expansion. Part of [Epic] RBAC beyond admin and user.

## Scope
- [ ] Auditor role wired into every read-surface API (policy, audit log, config, RBAC assignments)
- [ ] Exhaustive negative-path tests: every mutating endpoint rejects an auditor-scoped token
- [ ] Auditor access itself is audit-logged (using the SIEM-exportable audit log epic)

## Out of scope
- Auditor-specific UI/reporting views (functional API access is the scope here)

## Verification
An automated test sweep over every mutating endpoint in the API surface, asserting 403 for an auditor token; a passing review against the full endpoint inventory (not a sample).

## Risk assessment
An incomplete negative-path sweep (testing only some endpoints) reproduces the #177 gap in a new place; the test must enumerate the full endpoint list, not a hand-picked subset.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.