Org-scoped audit history for the caller

Returns audit entries scoped to the caller's org. Filters out `system` actors (cron housekeeping); masks internal `admin` actors to the stable label `'Artery support'` so customer can audit who touched their tenant without learning staff identity. Window defaults to last 7 days, capped at 90 days. Default sort `-ts` (only sort token supported). Default limit 50, max 500.