feat(audit): record permission denials centrally in the auth middleware

[clau1902]

Summary

Part 3 of 3 of the auth-failure auditing series — stacked on #411 and #412; review the last commit only until those merge.

403s from the authorization guards were previously invisible: a low-privilege credential probing admin endpoints left no trace.

PERMISSION_DENIED is recorded by AuthMiddleware whenever a response comes back FORBIDDEN. Observing the response centrally covers every guard macro (permission_guard!, project_scope_guard!, project_access_guard!, project_permission_guard!) and any added later, without threading the audit service into the guard macros. The event captures method, path, IP, user agent, and the denied credential (session, cli_token, api_key:<name>, deployment_token:<name>); the actor is optional because deployment tokens carry no user identity. Also wired into the web console filters, categorization, and descriptions.

Load justification

Fires only on rejected requests on the admin API (control plane) — one DB insert per denied request, the same cost class as the existing per-write audit logging. Allowed traffic pays nothing.

Test plan

• cargo test --lib -p temps-auth — 270 passed (includes PermissionDeniedAudit serialization/actor tests)
• cargo check --lib — full workspace, clean
• Web: tsc --noEmit + eslint clean on changed files

🤖 Generated with Claude Code