Cross-tenant audit log query (admin)

Window-bounded paged query for the internal-admin audit browser. `action` is matched as a case-insensitive substring (e.g. 'apikey' surfaces every apikey.* row). When `since`/`until` are omitted, the server defaults to the last 24h. The window is capped at 30 days; `limit` is clamped to [1, 500]. Both snake_case (`actor_id`, `org_id`, `target_type`) and the legacy camelCase forms are accepted for the actor / org filters to keep older callers working. Sortable: ts. Default sort: -ts.