Audit event catalog

Every event name isg writes to the audit log, in the order internal/audit/audit.go declares the constants — the same order the webUI's /audit event filter offers them in, since that dropdown is built from this same list.

This is a name catalog, not the schema. For the JSON shape of a log line, the file's location and permissions, the versioning rule and the rotation behavior an ingesting agent must tolerate, read docs/audit-schema.md — that document is the SIEM parser's contract and this one deliberately does not restate any of it. For what an individual event MEANS and what its details carry, read the constant's doc comment in internal/audit/audit.go.

The set of event names is explicitly not part of the audit schema's version and grows over time (audit-schema.md §2). That a name appears here is a statement about this build, not a promise about the next one.

Two tests in internal/audit keep this list honest: an event constant missing from AllEvents fails the build, and so does an AllEvents entry no constant declares — without them, generating the reference from a stale list would produce a stale file that matched the stale list perfectly.

116 events.