feat: JWT auth, user management, audit logging system

Co-Authored-By: Claude <noreply@anthropic.com>

backend/app/api/audit.py

@@ -0,0 +1,27 @@
+"""Audit API: list audit logs — only owner."""
+from fastapi import APIRouter, Depends, Query
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.database import get_db
+from app.middleware.auth import require_role
+from app.models.audit import AuditLog
+from app.models.user import User
+
+router = APIRouter(prefix="/api/v1/audit", tags=["audit"])
+
+
+@router.get("")
+async def list_audit(
+    page: int = Query(1, ge=1),
+    page_size: int = Query(20, ge=1, le=100),
+    action: str | None = Query(None),
+    user: User = Depends(require_role("owner")),
+    db: AsyncSession = Depends(get_db),
+):
+    query = select(AuditLog).order_by(AuditLog.created_at.desc())
+    if action:
+        query = query.where(AuditLog.action.ilike(f"%{action}%"))
+    query = query.offset((page - 1) * page_size).limit(page_size)
+    result = await db.execute(query)
+    return result.scalars().all()