feat(api): add redacted audit read endpoints

apps/api/src/control-plane.ts

@@ -26,6 +26,8 @@ import { registerInstanceRoutes } from './interface/http/instance-routes.js';
 import { registerEventRoutes } from './interface/http/event-routes.js';
 import { JobQueryService } from './application/jobs/job-query-service.js';
 import { registerJobRoutes } from './interface/http/job-routes.js';
+import { AuditQueryService } from './application/audit/audit-query-service.js';
+import { registerAuditRoutes } from './interface/http/audit-routes.js';
 
 export interface SafeControlPlaneUpstream extends ConnectionTransport {
   request: UpstreamSessionClientOptions['request'];
@@ -45,6 +47,7 @@ export interface ControlPlaneApp extends FastifyInstance {
 export function buildControlPlaneApp(options: ControlPlaneOptions): ControlPlaneApp {
   const eventJournal = new EventJournal(options.db);
   const jobs = new JobQueryService(options.db);
+  const audit = new AuditQueryService(options.db);
   const instances = options.now
     ? new InstanceService({ db: options.db, store: options.store, now: options.now })
     : new InstanceService({ db: options.db, store: options.store });
@@ -90,6 +93,7 @@ export function buildControlPlaneApp(options: ControlPlaneOptions): ControlPlane
       });
       registerOperationRoutes(app, operationCatalogRegistry, secureExecution, deletion);
       registerJobRoutes(app, { jobs });
+      registerAuditRoutes(app, { audit });
       registerEventRoutes(app, {
         journal: eventJournal,
         ...(options.authenticateEventStream