feat: implement audit events and principal roles

[manojbajaj95]

Summary

• implement ADR 005 with OTel audit events, a server-owned SQLite exporter, /audit/events query/post routes, and proxy fire-and-forget audit posts
• implement ADR 006 with persisted principal roles, first-principal-admin assignment, migration for existing principal rows, and route-level admin enforcement
• remove shallow audit model coverage and add ADR-focused tests for audit querying, proxy enrichment, role assignment, migration, and admin-only routes

Verification

• uv run ruff format src/ tests/
• uv run ruff check src/ tests/
• uv run ty check src/
• uv run pytest
• uv run pre-commit run --all-files

[beubax]

Do we need a separate get_admin_auth_service fastapi dependency? The guardrails are only in two places - one while mutating the provider client credentials and the other when displaying the provider UI (which is not an auth service property). Maybe we can just check for principal role in these two places