Add IdentityRestoredEvent audit log entry (restored)

Problem

After PR #635, an identity that is forgotten and later restored still ends the audit log on deprovisioned. Identity::restore() emits IdentityRestoredEvent, but Middleware does not map that event to an audit-log action and the event is also absent from AuditLogRepository::$secondFactorEvents.

Why this matters

For a live identity the terminal audit-log entry can read as if the account is still gone, because there is no matching restored entry after the earlier deprovisioned one.

Follow-up work

• add IdentityRestoredEvent::class => "restored" to the audit-log action map in Middleware
• include IdentityRestoredEvent in the audit-log query allowlist so the entry is visible to RA(A)s
• add/update tests for projector + repository behavior
• add the RA-side translation alongside the work already started in OpenConext/Stepup-RA#531

References

• PR #635
• OpenConext/Stepup-RA#531

Start with Identity::restore(), then inspect Middleware’s audit-log action map and AuditLogRepository::$secondFactorEvents, along with the existing projector and repository tests. Done means restored events produce a visible restored audit entry for RA(A)s, with matching tests and the related RA translation coordinated with OpenConext/Stepup-RA#531.