feat(security-audit): add first-class audit tenant contract

[man4ish]

Summary

Recover and release the SAT-1 first-class tenant contract for Security Audit.

Contract

• Adds nullable organization_id to the signed event envelope and durable record.
• Adds tenant_scope: organization, global, or unknown.
• organization requires an explicit authoritative organization ID.
• global is explicit only; missing tenant context remains unknown.
• context is never used as tenant authority.
• Legacy events remain organization_id=null, tenant_scope=unknown.

Integrity and storage

Tenant fields are serialized before signing and remain covered by the existing HMAC. Migration 0003_tenant_contract adds backward-compatible columns and the organization/time/event index. Existing platform-admin HTTP behavior is unchanged; organization-scoped authorization is not introduced.

Validation

• 77 focused SAT-1 tests passed
• Ruff passed on changed production files
• Changed-file Python compilation passed
• Migration/index validation passed
• git diff --check passed

Dependency

SAT-2 producer propagation must not begin until this contract is merged. This PR does not modify producer repositories.