feat: add audit log commands

[eslerm]

Add read-only audit log access for compliance and security review.

Scope

• 2 queries: auditEntries (paginated, filtered), auditEntryTypes (list available types)
• No mutations (read-only)
• New command group: audit list, audit types
• Filter support: --type, --actor, --created-after, --created-before, --ip
• Estimated ~800 LOC

Open Questions

• What permission level is required? (admin? owner?)
• Should --country-code be a filter?
• Pretty-print metadata or raw JSON?

See planning/03-audit-log.md