Add structured audit logging for all admin actions

[AbelOsaretin]

What

Admin score updates only emit console.log lines with no structured format. There is no audit trail for who triggered updates, when, or with what parameters.

Why

Compliance and forensics require structured audit logs. Without them, there is no way to investigate unauthorized or accidental score changes.

Scope

• Create a dedicated audit logger (separate from application logs)
• Log: timestamp, action, requester IP, user agent, project IDs, results
• Output to a dedicated audit log file or stream
• Include request correlation IDs

Acceptance Criteria

• Audit log entry for every POST /api/admin/update-scores call
• Entry includes: timestamp, action, IP, user agent, project IDs, success/failure
• Audit log is separate from application logs
• Entries are JSON-structured for parsing

Technical Context

• src/routes/admin.ts:48,50,57 — current console.log calls
• New file: src/lib/audit.ts or similar
• Could use a separate log file or a dedicated stream