fix(resource): pause/resume audit rows invisible in dashboard AuditPanel

[mastermanas805]

Bug (pause/resume class — user-facing, currently shipping)

resource.paused / resource.resumed audit events set only the ResourceID
column, not metadata.resource_id.

• The dashboard per-resource AuditPanel (instanode-web
fetchResourceAudit) filters the team audit window client-side by
  metadata.resource_id === resource.id.
• The api JSON serializer auditEventToMap surfaces only the JSONB
  metadata — the ResourceID column is never echoed onto the wire.

Net effect: a resource's two most important state-change events (pause, resume)
never appeared in its Audit tab, even though the audit rows existed. Every
other resource-scoped event (resource.read, connection_url.decrypted,
backup.requested) already sets metadata.resource_id; pause/resume were the
only two that didn't.

Coverage block

Symptom:       resource.paused / resource.resumed missing from per-resource Audit tab
Enumeration:   rg "InsertAuditEvent" + audit_log.go auditEventToMap (only JSONB metadata on wire);
               instanode-web fetchResourceAudit filter on metadata.resource_id
Sites found:   2 (resource.go Pause + Resume) — the only resource-scoped emits lacking metadata.resource_id
Sites touched: 2
Coverage test: TestPauseResource_EmitsMetadataResourceID + TestResumeResource_EmitsMetadataResourceID
               (verified to FAIL with the metadata removed)
Live verified: pending CI + deploy (api auto-deploys on merge to master)

Fix

Add resource_id (+ resource_type) to both emit sites, matching the existing
convention in emitResourceReadAudit / emitBackupAudit. This also restores
the server-side resource-ownership OR branch in
ListAuditEventsForCustomerExport, which keys on metadata->>'resource_id'
for cross-actor events.

Additive metadata only — no contract break. New tests pass; verified they fail
without the fix.

🤖 Generated with Claude Code