feat: add RBAC (read/write/admin) and persistent audit log

- Add Role enum to tokens: Read, Write, Admin (default: Read)
- Enforce role-based access in auth middleware (read-only tokens blocked from PUT/POST/DELETE)
- Add role field to token create/list/verify API
- Add persistent audit log (append-only JSONL) for all registry operations
- Audit logging across all registries: docker, npm, maven, pypi, cargo, raw

DevITWay

nora-registry/src/registry/pypi.rs

@@ -2,6 +2,7 @@
 // SPDX-License-Identifier: MIT
 
 use crate::activity_log::{ActionType, ActivityEntry};
+use crate::audit::AuditEntry;
 use crate::AppState;
 use axum::{
     extract::{Path, State},
@@ -115,6 +116,7 @@ async fn download_file(
             "pypi",
             "CACHE",
         ));
+        state.audit.log(AuditEntry::new("cache_hit", "api", "", "pypi", ""));
 
         let content_type = if filename.ends_with(".whl") {
             "application/zip"
@@ -156,6 +158,7 @@ async fn download_file(
                         "pypi",
                         "PROXY",
                     ));
+                    state.audit.log(AuditEntry::new("proxy_fetch", "api", "", "pypi", ""));
 
                     // Cache in local storage
                     let storage = state.storage.clone();