feat(audit): harden API audit log redaction and schema

- Change query_json column from TEXT to JSON, ip/user_agent to CHAR(64)
  for PII redaction compliance
- Update repository, service, and views for hardened schema
- Add architecture contract test for security logging redaction
- Add search resource provider test coverage
- Include DB migration script for existing installs

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

modules/audit/web/js/pages/admin-api-audit-index.js

@@ -85,7 +85,7 @@ if (config) {
           formatter: (cell) => (cell ? gridjs.html(`<code>${String(cell)}</code>`) : gridjs.html('-')),
         },
         {
-          name: labels.ip || 'IP',
+          name: labels.ip || 'IP hash',
           sort: false,
         },
         {
@@ -114,7 +114,7 @@ if (config) {
           label: row.tenant_label || '-',
         },
         row.error_code || '',
-        row.ip || '',
+        row.ip_hash || '',
         row.id,
       ]),
       rowInteraction: { linkColumn: 3 },