[Story]: Auditor read-only role with enforcement tests

## Summary
Implement and test the auditor (read-only) role: full read access to policy, audit-log and configuration surfaces, with zero mutation rights anywhere in the platform.

## Intent / Source of truth
Compliance workflows specifically require a role that can review evidence without being able to alter it — this is a named, distinct requirement from the general RBAC expansion. Part of [Epic] RBAC beyond admin and user.

## Scope
- [ ] Auditor role wired into every read-surface API (policy, audit log, config, RBAC assignments)
- [ ] Exhaustive negative-path tests: every mutating endpoint rejects an auditor-scoped token
- [ ] Auditor access itself is audit-logged (using the SIEM-exportable audit log epic)

## Out of scope
- Auditor-specific UI/reporting views (functional API access is the scope here)

## Verification
An automated test sweep over every mutating endpoint in the API surface, asserting 403 for an auditor token; a passing review against the full endpoint inventory (not a sample).

## Risk assessment
An incomplete negative-path sweep (testing only some endpoints) reproduces the #177 gap in a new place; the test must enumerate the full endpoint list, not a hand-picked subset.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation and enterprise-readiness research. A human owns intent, verification and consequences.

Begin by locating the API endpoint inventory and the existing RBAC enforcement entry points. Map every read surface and mutating endpoint, then verify completion with the full auditor-token sweep, 403 assertions, audit logging, and a review against the complete endpoint list.

Written by the indexing model from the issue text.