refactor(api): move audit-logs endpoint queries into MemoryEngine

[nicoloboschi]

Summary

The /audit-logs and /audit-logs/stats handlers ran raw SQL directly in the HTTP layer (acquire_with_retry + fq_table) instead of going through a MemoryEngine method. This violated the API-layer data-access standard (queries belong in the engine; auth/tenancy enforced there). This PR refactors them to follow the same pattern as the llm-requests endpoints in #1922.

Closes #1923.

Changes

• engine/memory_engine.py — add list_audit_logs(...) and audit_log_stats(...). Both start with get_bank_profile(..., create_if_missing=False), which calls _authenticate_tenant(request_context) before any query runs — so the SQL is now gated behind the same tenant authentication every other op uses and scoped to the authenticated tenant's schema. They return None for a missing bank, which the HTTP layer maps to 404.
• engine/audit.py — move the audit response models (AuditLogEntry, AuditLogListResponse, AuditLogStatsBucket, AuditLogStatsResponse) here so the engine can build and return them directly (previously inline in http.py).
• api/http.py — the two handlers now just delegate to the engine methods; all raw SQL / connection handling removed.
• tests/test_extensions.py — add tenant-auth regression tests (test_list_audit_logs_fails_with_invalid_api_key, test_audit_log_stats_fails_with_invalid_api_key) verifying the reads reject an invalid API key like other ops.

Verification

• Auth: the issue's "verify they go through authentication as other ops" concern is satisfied — auth is enforced via _authenticate_tenant inside get_bank_profile, now reached before the query, and covered by the two new tests.
• Lint (./scripts/hooks/lint.sh), ruff, and ty all pass.
• OpenAPI regenerated → byte-identical (model names/fields unchanged), so no client SDK regeneration needed; control-plane proxy routes unchanged.
• Tests: 13 existing audit integration tests + 7 tenant-auth tests (incl. 2 new) all pass.