📝 Add Athena query examples for audit archive

Summary

Provide documentation and examples for querying archived audit data in S3 using Amazon Athena.

Background

Issue #77 implements JSONL audit archival to S3. Users need guidance on how to query this data for compliance and forensic analysis.

Scope

• Sample CREATE EXTERNAL TABLE DDL for JSONL audit data
• Common query examples:
  • Find all actions by a specific principal
  • Find all actions on a specific entity
  • Aggregate actions by type over time
  • Search for specific patterns in details
• Note that Athena can query JSONL directly (no Parquet conversion needed for moderate volumes)
• Optional: Glue ETL snippet to convert JSONL → Parquet for large datasets

Documentation Location

docs/infra/auditing.md - Add "Querying Archived Audit Data" section

Example DDL

CREATE EXTERNAL TABLE audit_archive (
  entity_id STRING,
  action STRING,
  principal STRING,
  timestamp STRING,
  details STRING
)
PARTITIONED BY (year STRING, month STRING, day STRING)
ROW FORMAT SERDE 'org.openx.data.jsonserde.JsonSerDe'
LOCATION 's3://my-audit-bucket/audit/'

Notes

• Athena and Glue are not available in LocalStack free edition
• Examples should be tested against real AWS
• Consider cost implications (Athena charges per TB scanned)

Related

• #77 - S3 audit archive implementation (prerequisite)

Start with docs/infra/auditing.md and review the JSONL archive layout described in issue #77. Add the requested Athena DDL and query examples, plus the cost and LocalStack limitations; validate examples against real AWS, with the optional Glue conversion snippet clearly separated.