fix(audit): scope enterprise audit logs by org

[Nav-Prak]

Purpose / Description

Scope enterprise audit-log reads to the caller's organization so a tenant admin cannot list or export another organization's audit trail.

This is part of the AUDIT2 tenant-scoping work and is split out from the closed broader tenant-scope PR #1184 to keep the audit change independently reviewable.

Fixes

• Refs Fix tenant scoping for review, eval, audit, and security events #1184
• Addresses AUDIT2 tenant-scoping for enterprise audit-log paths

Approach

This change stamps audit rows with an org_id and filters audit-log list/export queries by the current admin's org.

• Adds org_id to audit event flow where needed.
• Resolves the actor's organization when buffering audit rows.
• Adds org filtering to enterprise audit-log list and export routes.
• Preserves org-less/local-mode admin behavior by omitting the org filter when the caller has no org.
• Handles SCIM user deletion specially by capturing org_id before deleting the user, since the row cannot be resolved after deletion.

How Has This Been Tested?

Targeted audit tenant-scope tests:

cd observal-server && uv run --with pytest --with pytest-asyncio --with pyyaml \
  --with typer --with rich --with hypothesis --with pyarrow \
  pytest ../tests/test_tenant_scope_audit.py ../tests/test_audit_logging.py -q

Result: audit tenant-scope tests passed, including the SCIM user-deletion org preservation case.

Lint/format:

uv run --with ruff==0.15.10 ruff check \
  ee/observal_server/routes/audit.py \
  ee/observal_server/routes/scim.py \
  ee/observal_server/services/audit.py \
  observal-server/services/events.py \
  tests/test_tenant_scope_audit.py \
  tests/test_audit_logging.py

uv run --with ruff==0.15.10 ruff format --check \
  ee/observal_server/routes/audit.py \
  ee/observal_server/routes/scim.py \
  ee/observal_server/services/audit.py \
  observal-server/services/events.py \
  tests/test_tenant_scope_audit.py \
  tests/test_audit_logging.py

Also re-ran adjacent audit/events/HIPAA/SCIM suites as part of split verification; no regressions were found.

Checklist

• You have a descriptive commit message with a short title (first line, max 50 chars).
• You have commented your code, particularly in hard-to-understand areas
• You have performed a self-review of your own code
• UI changes: not applicable; no UI changes in this PR

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!