feat(api): add audit domain with event bus, retention lifecycle, and log export

record domain events from auth, authorization, employee, cv, questionnaire,
and document flows through a dedicated event-bus consumer; expose a filtered
log query api with keyset pagination, stats, and csv/jsonl export gated by
audit.export; manage retention policies with a queued chunked command and
sensitive-data sanitization; enforce the bidirectional domain boundary with
arch and catalog-sync tests.