fix(audit): emit AuthPermissionDenied, HttpRequestDenied, AuthPasswordChanged

[rrrodzilla]

Summary

Closes Tier 1 of #16. Three AuditEventKind variants were declared as public API and listed in every storage parser but had no emission site in the framework. Downstream apps that rely on the framework for an audit trail got silent gaps for Cedar policy denials, rate-limit rejections, and password changes. This PR fills them in at the places where the framework already owns the code and has the AuditLogger in scope.

Changes

AuthPermissionDenied

• HTTP (middleware/cedar.rs) — emit on Decision::Deny with a populated AuditSource (IP from X-Forwarded-For / X-Real-IP, user-agent, subject from JWT claims, request-id). Severity: Warning.
• gRPC (middleware/cedar.rs) — emit on Decision::Deny with subject + UA + request-id from gRPC metadata. gRPC has no peer IP at this layer; ip stays None. Severity: Warning.

HttpRequestDenied

• middleware/rate_limit.rs — emit when check_rate_limit_with_route returns Error::RateLimitExceeded. Other error variants (Redis down, etc.) are not audit-worthy and don't emit. Severity: Warning.

AuthPasswordChanged

• accounts/mod.rs — AuditAccountNotification was coarsely mapping AccountEvent::PasswordChanged to AuditEventKind::AccountUpdated with action: "password_changed" metadata. Remapped to the dedicated AuthPasswordChanged kind at Notice severity. Downstream consumers parsing the kind now get a distinct, security-relevant event instead of having to inspect metadata.

Breaking change

The AccountUpdated event with action: "password_changed" no longer fires. Downstream SIEM rules keyed on that combination need to switch to auth.password.changed. Justifies a minor-version bump.

Out of scope (tracked under #16)

• Tier 2 — AuthApiKeyCreated, AuthApiKeyRevoked, AuthTokenRefresh — these live behind storage traits (ApiKeyStorage, RefreshTokenStorage) that don't carry an AuditLogger. Needs a notification-handler pattern like AuditAccountNotification for each, wired through all four backends.
• Tier 3 — AuthLogout, AuthOAuthCallback — AuthSession::logout() is sync and has no path to the AuditLogger; the OAuth callback path isn't owned by the framework. Both need design decisions before implementation.

Test plan

• cargo clippy -p acton-service --all-targets --features full -- -D warnings — clean
• cargo clippy -p acton-service --all-targets --no-default-features --features "full,crypto-ring" -- -D warnings — clean
• cargo nextest run -p acton-service --features full — 520/520 pass
• Verify downstream (schemaforge) sees the three new event kinds reach storage and roll up correctly in SIEM dashboards.