Audit Log Service

Create a small service that accepts security-relevant events (login, permission change, data export) and stores them in append-only form. Include an authenticated read API with filtering, and add tests for write/read paths.