feat: add redacted tenant audit queries

contracts/openapi/aioa-v1.yaml

@@ -1,12 +1,24 @@
 openapi: 3.1.0
 info:
   title: AIOA API
-  version: 0.12.0
+  version: 0.13.0
 servers:
   - url: /api/v1
 security:
   - bearerAuth: []
 paths:
+  /admin/audit-events:
+    get:
+      operationId: listRedactedTenantAuditEvents
+      summary: OA 管理员按租户脱敏查询审计记录
+      parameters:
+        - { name: traceId, in: query, schema: { type: string, maxLength: 128 } }
+        - { name: action, in: query, schema: { type: string, maxLength: 120 } }
+        - { name: resourceType, in: query, schema: { type: string, maxLength: 120 } }
+        - { name: limit, in: query, schema: { type: integer, minimum: 1, maximum: 200, default: 100 } }
+      responses:
+        "200": { description: 当前租户的脱敏审计记录 }
+        "403": { description: 仅 OA 管理员可查询 }
   /devices/register:
     post:
       operationId: registerCurrentDevice
@@ -631,11 +643,11 @@ components:
           uniqueItems: true
           items:
             type: string
-            enum: [LEAVE_REQUEST_READ_OWN, LEAVE_REQUEST_WRITE_OWN, LEAVE_ATTACHMENT_MANAGE_OWN, NOTIFICATION_READ_OWN, AI_LEAVE_DRAFT_SUGGEST, AI_LEAVE_PROGRESS_READ_OWN, APPROVAL_TASK_READ_ASSIGNED, APPROVAL_TASK_DECIDE_ASSIGNED]
+            enum: [LEAVE_REQUEST_READ_OWN, LEAVE_REQUEST_WRITE_OWN, LEAVE_ATTACHMENT_MANAGE_OWN, NOTIFICATION_READ_OWN, AI_LEAVE_DRAFT_SUGGEST, AI_LEAVE_PROGRESS_READ_OWN, APPROVAL_TASK_READ_ASSIGNED, APPROVAL_TASK_DECIDE_ASSIGNED, AUDIT_READ_TENANT_REDACTED]
         dataScopes:
           type: array
           uniqueItems: true
-          items: { type: string, enum: [OWN, ASSIGNED] }
+          items: { type: string, enum: [OWN, ASSIGNED, TENANT] }
     OrganizationRef:
       type: object
       required: [id, name]