dashboard: no audit trail for destructive actions

There is no audit logging anywhere in the dashboard server — grep -rni "audit" packages/ts-cloud/src/deploy returns no hits.

Destructive operations execute with no record of who performed them:

• user removal — local-dashboard-server.ts:999
• site deletion — :817
• SSH key deletion — :720
• firewall changes — :762
• shell command execution — :1031

On a box hosting multiple tenants (the attachTo shared-box model), this makes incident response and after-the-fact attribution impossible: there's no way to answer "who removed this site, and when".

Suggested fix

Append-only audit log capturing actor, action, target, timestamp, and outcome for every state-changing endpoint — written server-side in the guard/handler layer rather than per-route, so new endpoints are covered by default.

Roadmap relationship: tracked by #137 under master roadmap #132.

Implemented and pushed to main in d99b56c (feat(audit): record every dashboard mutation).

Evidence:

• wraps all dashboard/API mutation responses in one audit envelope
• records organization/project scope, actor when authenticated, request correlation ID, method/path/target, status, duration, and success/failure outcome
• allowlists safe request metadata and omits secret values, passwords, confirmations, and arbitrary fields
• returns the correlation ID as x-request-id for operator support
• added focused regression coverage; dashboard tests and package typecheck pass