feat(audit): expose GET /v1/audit-log endpoint (last N entries, tenant-scoped)

src/audit/audit.controller.ts

@@ -0,0 +1,22 @@
+import { Controller, Get, Query } from '@nestjs/common';
+import { desc, eq } from 'drizzle-orm';
+import { CurrentSession } from '../auth/session.decorator';
+import type { AuthenticatedSession } from '../auth/tenant.guard';
+import { db } from '../db/client';
+import { auditLog } from '../db/schema';
+
+@Controller('audit-log')
+export class AuditLogController {
+  @Get()
+  async list(
+    @CurrentSession() session: AuthenticatedSession,
+    @Query('limit') limitStr?: string,
+  ) {
+    const limit = Math.min(Math.max(1, parseInt(limitStr ?? '100', 10) || 100), 500);
+    return db.query.auditLog.findMany({
+      where: eq(auditLog.tenantId, session.tenantId),
+      orderBy: desc(auditLog.createdAt),
+      limit,
+    });
+  }
+}