chore(release): bump workspace to 0.27.0

[rrrodzilla]

Summary

Workspace version bump for the 0.27.0 release. This PR is the precondition to running cargo release tag --execute && cargo release publish --execute against main after merge.

Changes

• Cargo.toml workspace version: 0.26.1 → 0.27.0
• Cargo.lock regenerated by cargo release version minor -p acton-service --execute --no-confirm
• acton-docs/src/lib/version.ts — VERSION constant bumped (per CLAUDE.md release checklist)
• acton-docs/src/markdoc/config.js — ACTON_VERSION constant bumped
• acton-docs/src/markdoc/functions.js — ACTON_VERSION constant bumped
• CHANGELOG.md — populated the [Unreleased] section with the 0.27.0 entry, covering all breaking changes, new emissions, fixes, and documentation work from fix(audit): stop emitting auth.login.failed for unauthenticated requests #14, fix(audit): parse config.*, account.*, and lockout event strings back to typed variants #21, fix(audit): emit AuthPermissionDenied, HttpRequestDenied, AuthPasswordChanged #22, fix(audit): align AccountExpired/Deleted severities; bump AuthLoginSuccess to Notice #23, fix(audit): warn when storage parser falls back to Custom for framework namespace #24, fix(audit): attach jti to AuthTokenRevoked event metadata #25, docs(audit): update audit-event docs for 0.27 emission changes #27.

Why minor, not patch

Six PRs in this cycle introduce observable behavior changes to the audit-event surface that downstream SIEM rules can key on:

• AuthLoginFailed no longer middleware-emitted (fix(audit): stop emitting auth.login.failed for unauthenticated requests #14)
• AccountUpdated+action:password_changed replaced by AuthPasswordChanged (fix(audit): emit AuthPermissionDenied, HttpRequestDenied, AuthPasswordChanged #22)
• AuthLoginSuccess severity Informational → Notice (fix(audit): align AccountExpired/Deleted severities; bump AuthLoginSuccess to Notice #23)
• AccountExpired severity Notice → Warning (fix(audit): align AccountExpired/Deleted severities; bump AuthLoginSuccess to Notice #23)

Per SemVer, observable-behavior changes that aren't bug fixes warrant a minor bump.

Test plan

• cargo check --workspace — clean
• Pre-bump CI on all the constituent PRs was green
• CI on this PR runs the workspace once at the new version before merge

Follow-up (after merge)

```
git pull --ff-only
cargo release tag --execute --no-confirm
cargo release publish --execute --no-confirm
git push origin acton-service-v0.27.0
```

Closes #13 #15 #18 #19 #20 #19 (refs partial #16)