feat(mgmt): /api/audit/{query,export} endpoints with permission gates (#23 M8)

src/ScadaLink.Security/LdapAuthService.cs

@@ -15,7 +15,9 @@ public class LdapAuthService
         _logger = logger ?? throw new ArgumentNullException(nameof(logger));
     }
 
-    public async Task<LdapAuthResult> AuthenticateAsync(string username, string password, CancellationToken ct = default)
+    // virtual: a test seam so HTTP-pipeline tests (e.g. the #23 M8 audit
+    // endpoints) can substitute the LDAP bind without standing up a directory.
+    public virtual async Task<LdapAuthResult> AuthenticateAsync(string username, string password, CancellationToken ct = default)
     {
         if (string.IsNullOrWhiteSpace(username))
             return new LdapAuthResult(false, null, null, null, "Username is required.");