refactor(audit): extract audit domain into self-contained module

Move the entire audit subsystem (system audit, API audit, import audit,
user lifecycle audit, frontend telemetry) from core into modules/audit/.

Core decoupling via interface-based injection:
- AuditRecorderInterface replaces SystemAuditService in 10+ core services
- UserLifecycleAuditInterface / ImportAuditInterface for specialized flows
- NullAuditRecorder fallback when audit module is disabled
- ApiBootstrap/ApiResponse use null-safe callable resolvers

Module structure (modules/audit/):
- Manifest with routes, permissions, scheduler jobs, authorization policy
- 9 services, 8 repositories, 6 domain enums, 4 job handlers
- 33 page files, 4 JS files, 8 test files, migration scripts, i18n

Core cleanup:
- OperationsAuthorizationPolicy, UiCapabilityMap, PermissionService
  surgically cleaned of audit-specific constants
- Sidebar template cleared of hardcoded audit navigation
- AuditModuleIsolationContractTest ensures no future core→module coupling

All quality gates pass: 1346 tests (19,276 assertions), PHPStan level 5
clean, architecture contracts verified.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

modules/audit/web/js/pages/admin-api-audit-index.js

@@ -0,0 +1,147 @@
+import { initStandardListPage } from '../core/app-grid-factory.js';
+import { readPageConfig } from '../core/app-page-config.js';
+import { warnOnce } from '../core/app-dom.js';
+import { getAppBase, withCurrentListReturn } from './app-list-utils.js';
+
+const config = readPageConfig('admin-api-audit-index');
+if (config) {
+  const appBase = getAppBase();
+  const gridSearch = config.gridSearch ?? null;
+  const filterSchema = config.filterSchema ?? [];
+  const filterChipMeta = config.filterChipMeta ?? [];
+  const labels = config.labels ?? {};
+
+  const initApiAuditGrid = () => {
+    const gridOptions = {
+      gridjs: window.gridjs,
+      container: '#api-audit-grid',
+      dataUrl: 'admin/api-audit/data',
+      appBase,
+      columns: [
+        {
+          name: labels.created || 'Created',
+          sort: true,
+        },
+        {
+          name: labels.statusCode || 'Status code',
+          sort: true,
+          formatter: (cell) => {
+            if (!cell || typeof cell !== 'object') {
+              return gridjs.html('');
+            }
+            return gridjs.html(`<span class="badge" data-variant="${cell.variant || 'neutral'}">${cell.label || ''}</span>`);
+          },
+        },
+        {
+          name: labels.method || 'Method',
+          sort: true,
+          formatter: (cell) => {
+            const method = String(cell || '').toUpperCase();
+            return gridjs.html(`<span class="badge" data-variant="neutral">${method}</span>`);
+          },
+        },
+        {
+          name: labels.path || 'Path',
+          sort: true,
+        },
+        {
+          name: labels.durationMs || 'Duration (ms)',
+          sort: true,
+          formatter: (cell) => (cell > 0 ? `${cell}` : '-'),
+        },
+        {
+          name: labels.user || 'User',
+          sort: false,
+          formatter: (cell) => {
+            if (!cell || typeof cell !== 'object') {
+              return gridjs.html('-');
+            }
+            const label = cell.label || '-';
+            if (!cell.uuid) {
+              return gridjs.html(label);
+            }
+            const url = withCurrentListReturn(new URL(`admin/users/edit/${cell.uuid}`, appBase).toString());
+            return gridjs.html(`<a href="${url}">${label}</a>`);
+          },
+        },
+        {
+          name: labels.tenant || 'Tenant',
+          sort: false,
+          formatter: (cell) => {
+            if (!cell || typeof cell !== 'object') {
+              return gridjs.html('-');
+            }
+            const label = cell.label || '-';
+            if (!cell.uuid) {
+              return gridjs.html(label);
+            }
+            const url = withCurrentListReturn(new URL(`admin/tenants/edit/${cell.uuid}`, appBase).toString());
+            return gridjs.html(`<a href="${url}">${label}</a>`);
+          },
+        },
+        {
+          name: labels.errorCode || 'Error code',
+          sort: false,
+          formatter: (cell) => (cell ? gridjs.html(`<code>${String(cell)}</code>`) : gridjs.html('-')),
+        },
+        {
+          name: labels.ip || 'IP',
+          sort: false,
+        },
+        {
+          name: 'ID',
+          hidden: true,
+        },
+      ],
+      sortColumns: ['created_at', 'status_code', 'method', 'path', 'duration_ms', null, null, null, null, null],
+      paginationLimit: 10,
+      language: config.gridLang ?? {},
+      mapData: (data) => data.data.map((row) => [
+        row.created_at,
+        {
+          variant: row.status_badge,
+          label: String(row.status_code || ''),
+        },
+        row.method,
+        row.path,
+        row.duration_ms,
+        {
+          uuid: row.user_uuid || '',
+          label: row.user_label || '-',
+        },
+        {
+          uuid: row.tenant_uuid || '',
+          label: row.tenant_label || '-',
+        },
+        row.error_code || '',
+        row.ip || '',
+        row.id,
+      ]),
+      rowInteraction: { linkColumn: 3 },
+      search: gridSearch,
+      filterSchema,
+      urlSync: true,
+      rowDblClick: {
+        getUrl: (rowData) => {
+          const id = rowData?.cells?.[9]?.data;
+          return id ? new URL(`admin/api-audit/view/${id}`, appBase).toString() : '';
+        },
+      },
+    };
+    const { gridConfig } = initStandardListPage({
+      grid: gridOptions,
+      filters: {
+        mode: 'drawer',
+        chipMeta: filterChipMeta,
+        watchInputs: ['#api-audit-search'],
+      },
+    });
+    if (!gridConfig || !gridConfig.grid) {
+      warnOnce('UI_INIT_FAIL', 'API audit grid init failed', { module: 'admin-api-audit-index', component: 'grid' });
+      return null;
+    }
+    return gridConfig;
+  };
+
+  initApiAuditGrid();
+}