fix: add missing /api prefix to audit fetch URLs so rewrite proxy reaches backend router at /api/audit/event

fix: stabilize useAuditTrail return reference with useMemo, remove setLoading(true) from effect re-fetches

feat: 4-layer audit/observability system