feat(audit): add filtered investigation and contextual evidence

[rrrodzilla]

Administrator audit browsing previously exposed sequence and integrity fields without enough context to investigate activity. Add newest-first snapshot paging with exact actor, subject, schema, entity, event, severity, request, status and time filters while preserving the original ascending API.

Expose an allowlisted evidence projection with request context, resource identifiers, changed field names, typed role changes and account state. Capture correlated entity mutations and read refusals, reuse resolved context for authentication and password changes, and correct the password self-service flag. Historical missing fields remain null; audit delivery remains asynchronous. Metadata filters use the same recognized producer boundary as projection, and query strings, field values and arbitrary metadata stay excluded.

Also redact database credentials from CLI connection and bootstrap messages. Upgrade acton-service to 0.43.0, the acton integration crate to 0.42.0 and the CLI to 0.43.0.

Validation:

• 718 PostgreSQL-enabled acton tests passed, including paging, authorization, combined filtering, safe projection and capture helpers.
• All 276 PostgreSQL CLI unit tests passed, including the connection-redaction regression.
• PostgreSQL acton and CLI clippy passed with warnings denied.
• A disposable PostgreSQL instance passed real HTTP mutation, filter, correlation, authorization and bounded chain-verification checks.