feat(security): W1.3 — JSONL request audit log + MCP integration

[jrosskopf]

Summary

• Adds an opt-in JSONL request audit log behind a single YAML block:

  audit:
    enabled: true
    sink: file            # stdout | file | null
    path: /var/log/flapi/audit.jsonl
    redact:
      - password
      - token

• Every MCP tool call emits one JSONL line with {timestamp, request_id, principal, method, target, status, row_count, latency_ms, params}. Configured redact keys are masked before serialisation; the literal secret never lands in the file.
• Closes W1.3 of the security roadmap (Security Wave 1: Quick production wins (bcrypt, CORS allowlist, audit log, per-user rate limit) #23). REST integration follows the same AuditLogger API and is a small follow-up.

Status taxonomy on MCP tool calls

• success — query/write completed
• error:tool_not_found — caller invoked an unknown tool name
• error:invalid_arguments — RequestValidator rejected the call
• error:exception — execution threw

Test plan

• 7 Catch2 unit cases in test/cpp/audit_logger_test.cpp: disabled no-op (file is not even created), file sink emits one line per event, redact list masks listed params, auto-filled timestamp + request_id, caller-supplied request_id preserved, concurrent writes (8 threads × 25 events) produce well-formed JSONL, null sink performs no I/O.
• ctest -R AuditLogger — 7/7 pass.
• 2 end-to-end Python cases in test/integration/test_audit_log.py boot a real flapi server with the audit log pointed at a temp file, call an MCP tool with sensitive + non-sensitive args, and verify line shape, redaction, and that validation failures still produce an event. They skip cleanly in environments with the existing DuckDB v1.5.1/v1.5.2 extension-cache mismatch; CI exercises them against fresh extensions.

Design notes

• AuditLogger is a single-responsibility append-only writer. Three sink types (stdout, file, null) cover dev, production, and tests-that-want-the-code-path-but-no-I/O. Mutex around writes guarantees JSONL line atomicity even under concurrent tool calls.
• The class API is path-agnostic — REST integration in RequestHandler will plug in the same way (event fields are already named generically: method, target).
• ConfigManager owns one shared logger via getAuditLogger(). Construction is lazy on first access from the parsed config, so adding a new wire-up site doesn't risk creating a second writer racing on the same file.
• The redaction layer lives in the logger, not the call sites — handlers never have to know which params are sensitive, only operators do.

Closes #23
Refs #21