Add audit log infrastructure and GET /v1/audit-logs endpoint

Introduces an append-only audit trail for all user and system actions:
sandbox lifecycle (create/pause/resume/destroy/auto-pause), snapshots,
team rename, API key create/revoke, member add/remove/leave/role_update,
and BYOC host add/delete/marked_down/marked_up.

- New audit_logs table (migration) with team_id, actor, resource,
  action, scope (team|admin), status (success|info|warning|error),
  metadata, and created_at
- AuditLogger (internal/audit) with named fire-and-forget methods per
  event; system actor used for background events (HostMonitor, TTL reaper)
- GET /v1/audit-logs: JWT-only, cursor pagination (max 200), multi-value
  filters for resource_type and action (comma-sep or repeated params);
  members see team-scoped events only, admins/owners see all
- AuthContext extended with APIKeyID + APIKeyName so API key requests
  record meaningful actor identity
- HostMonitor wired with AuditLogger for auto-pause and host marked_down

internal/api/handlers_sandbox.go

@@ -7,17 +7,19 @@ import (
 
 	"github.com/go-chi/chi/v5"
 
+	"git.omukk.dev/wrenn/sandbox/internal/audit"
 	"git.omukk.dev/wrenn/sandbox/internal/auth"
 	"git.omukk.dev/wrenn/sandbox/internal/db"
 	"git.omukk.dev/wrenn/sandbox/internal/service"
 )
 
 type sandboxHandler struct {
-	svc *service.SandboxService
+	svc   *service.SandboxService
+	audit *audit.AuditLogger
 }
 
-func newSandboxHandler(svc *service.SandboxService) *sandboxHandler {
-	return &sandboxHandler{svc: svc}
+func newSandboxHandler(svc *service.SandboxService, al *audit.AuditLogger) *sandboxHandler {
+	return &sandboxHandler{svc: svc, audit: al}
 }
 
 type createSandboxRequest struct {
@@ -97,6 +99,7 @@ func (h *sandboxHandler) Create(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	h.audit.LogSandboxCreate(r.Context(), ac, sb.ID, sb.Template)
 	writeJSON(w, http.StatusCreated, sandboxToResponse(sb))
 }
 
@@ -143,6 +146,7 @@ func (h *sandboxHandler) Pause(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	h.audit.LogSandboxPause(r.Context(), ac, sandboxID)
 	writeJSON(w, http.StatusOK, sandboxToResponse(sb))
 }
 
@@ -158,6 +162,7 @@ func (h *sandboxHandler) Resume(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	h.audit.LogSandboxResume(r.Context(), ac, sandboxID)
 	writeJSON(w, http.StatusOK, sandboxToResponse(sb))
 }
 
@@ -186,5 +191,6 @@ func (h *sandboxHandler) Destroy(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	h.audit.LogSandboxDestroy(r.Context(), ac, sandboxID)
 	w.WriteHeader(http.StatusNoContent)
 }