feat(security-audit): add tenant-safe audit query API

[man4ish]

Summary

• Add GET /audit/events/safe with verified platform-wide or organization-admin authorization.
• Apply tenant filtering in SQL before count, ordering, and pagination; reject cross-tenant overrides.
• Restrict response metadata to the safe allowlist and normalize integrity/source semantics.
• Report unavailable audit storage as a safe 503; freshness, retention, and ingestion lag remain UNKNOWN.

Security and compatibility

• Organization scope comes only from verified authenticated organization-admin context.
• Organization callers see organization-scoped rows for their organization only; GLOBAL and UNKNOWN are excluded.
• Platform-wide access remains governed by manage_all_orgs.
• Legacy events remain UNKNOWN and existing read-only behavior is preserved.
• SAT-1 signing, persistence, migration 0003_tenant_contract, and tenant/time/event index remain authoritative.
• No JWTs, tokens, headers, credentials, request bodies, SQL, paths, or signing material are exposed.

Validation

• Full Security Audit suite: 294 passed.
• Focused safe-route, source-semantics, audit, query, and migration suite: 44 passed.
• Changed-file Ruff, compilation, Alembic head/history, and git diff --check passed.
• Live tenant certification passed for authorized organization access, 401/403 boundaries, cross-tenant override rejection, UNKNOWN exclusion, safe metadata, read-only methods, and source-unavailable handling.

SAT-2 producer changes are not included. TES and Workflow live producer fixtures remain separate evidence limitations; this PR does not claim ecosystem-wide producer completeness.