Kibana audit logs shipped through the OTel appender use OpenTelemetry field names

## Summary

PR #275238 makes the Kibana audit service transform audit event fields when the audit appender is of type otel: trace.id is renamed to request.id, http.request.method is uppercased, request headers move from a plural headers object to singular per-key header attributes, service.version and host.name are dropped, and event.type defaults to access for authentication events that omit it. Audit logs written to file or console appenders keep the documented ECS shape. The otel appender itself is already documented in the Kibana logging settings reference, so users who ship audit logs to an OTLP endpoint will see field names that differ from the published audit schema.

**Why this needs docs:** Why this needs docs: the Kibana audit events reference documents an exact ECS field schema (trace.id, lowercase http.request.method, http.request.headers.*) that is no longer what users receive when the documented otel appender is used for audit logs.

## Resources

- PR [#275238](https://github.com/elastic/kibana/pull/275238) — [OTel][Audit Log] Transform Audit Log ECS fields to canonical OTel names
- Product issue: https://github.com/elastic/kibana/issues/273943

## Availability

| Channel | Details |
|---------|---------|
| **Stack** | v9.6.0 |
| **Serverless** | Jul 20–Jul 24 |
| **Feature flag** | None — active by default |

---
*Created with [Docs Quest Scanner](https://github.com/florent-leborgne/docs-quest-scanner) by @florent-leborgne*

## Suggested edits

[Kibana audit events](https://www.elastic.co/docs/reference/kibana/kibana-audit-events) > Audit schema
- **What the docs say:** Audit logs are written in JSON using Elastic Common Schema (ECS)... Field: trace.id — Unique identifier allowing events of the same transaction from Kibana and Elasticsearch to be correlated. Field: http.request.method — Example: get, post, put, delete. Field: http.request.headers.x-forwarded-for.
- **What to add:** Add a scoped note to the audit schema section stating that when audit logs are shipped through an appender of type otel, some fields are transformed to OpenTelemetry conventions: trace.id becomes request.id, http.request.method is uppercase (GET instead of get), request headers are emitted as singular per-key http.request.header attributes, service.version and host.name are omitted, and event.type defaults to access on authentication events. Without this note, the documented schema is wrong for OTLP consumers. Applies from 9.6.0 and in serverless.

Start at the Kibana audit events reference, specifically the Audit schema section, and review the existing ECS field descriptions alongside the otel appender behavior described in PR #275238. Done means the page clearly scopes the transformed field names, omitted fields, authentication default, and 9.6.0/serverless applicability without changing the file or console schema.

Written by the indexing model from the issue text.