feat(audit): implement comprehensive audit logging system

[wellCh4n]

Add a complete audit logging system to track all critical operations in the platform.

Core Components

Domain Layer

• AuditLog entity with full operation metadata (user, source, resource, timestamp, success/failure)
• OperationSource enum (USER, OPENAPI, SCHEDULED, SYSTEM) to distinguish operation origins

Application Layer

• AuditService with async logging to avoid impacting main operations
• Query methods using JpaSpecificationExecutor for flexible dynamic filtering
• AuditLogRepository with Specification support for any combination of filters

Infrastructure Layer

• AuditAspect using AOP to automatically intercept @Auditable methods
• Determines operation source by inspecting request URI (/api/** vs /openapi/**)
• Extracts user info, resource details, and client IP automatically

Interface Layer

• @Auditable annotation for declarative audit marking
• AuditLogController with admin query endpoint and per-application audit view
• Applied audit annotations to all key operations:
  • Application: CREATE_APP, UPDATE_APP, DELETE_APP, MIGRATE_NAMESPACE
  • Deployment: DEPLOY
  • Pipeline: STOP_PIPELINE, DEPLOY_PIPELINE, ROLLBACK
  • Environment: CREATE_ENV, UPDATE_ENV, DELETE_ENV
  • User: CREATE_USER, UPDATE_USER, DELETE_USER
  • Config: UPDATE_CONFIG

Database

• V19 migration creates audit_log table with indexes on resource, user, namespace, timestamp, source

Key Features

• Asynchronous logging: Uses @async with REQUIRES_NEW propagation to ensure audit logs are saved even if main transaction fails
• Non-invasive: AOP-based approach requires only @Auditable annotation on methods
• Source tracking: Automatically distinguishes USER (Web UI) vs OPENAPI (CLI/skill) operations
• Failure tolerance: Audit logging failures never impact main business operations
• Flexible queries: Specification-based queries support any combination of filters without adding repository methods

API Endpoints

• GET /api/audit-logs (admin only) - query with filters (resourceType, resourceId, userId, namespace, source)
• GET /api/audit-logs/namespaces/{ns}/applications/{name} - per-app audit log