feat: add audit logging to tenant and destination CRUD

[alexluong]

Summary

• Adds logger.Audit() calls to all tenant and destination mutation handlers (create, update, delete, enable, disable)
• Adds test suite using zap/zaptest/observer to verify audit log emission and field correctness
• Includes a no-op test confirming disable on an already-disabled destination does not emit

Closes #235

Coverage

All production mutation paths are now audited:

• API handlers (this PR): tenant upsert/delete, destination create/update/delete/enable/disable
• Alert monitor (already covered): automatic destination disable on consecutive failures

Test plan

• go test ./internal/apirouter/... -run TestAuditLog — all 9 cases pass
• Full ./internal/apirouter/... suite passes
• Verify audit logs appear in structured JSON output with AUDIT_LOG=true

🤖 Generated with Claude Code