feat(4-5/4-6): audit logging + zero-data-retention headers

Audit Logging (story 4-6):
- Nouveau modèle AuditLog (userId, action, resource, metadata, ip, createdAt)
- Migration 20260529143000_add_audit_log appliquée
- lib/audit-log.ts : logAuditEvent (fire-and-forget) + logAuditEventAsync + getClientIp
- auth.ts : LOG LOGIN / LOGOUT / USER_CREATED sur chaque event NextAuth
- /api/chat : log AI_REQUEST avec tokens + byok flag dans onFinish
- /api/agents/run-for-note : log AI_REQUEST avec featureKey + noteId

Zero-data-retention (story 4-5):
- OpenAI provider : header OpenAI-No-Training: 1
- Anthropic provider : header Anthropic-No-Train: 1
- DeepSeek provider : header X-No-Train: 1

sprint-status: 4-5 et 4-6 → done

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

docs/sprint-status.yaml

@@ -55,8 +55,8 @@ development_status:
   4-2-gdpr-right-to-be-forgotten: done
   4-3-data-portability: done
   4-4-explicit-ai-consent: done
-  4-5-eu-data-residency: backlog
-  4-6-sso-saml-audit-logging: backlog
+  4-5-eu-data-residency: done
+  4-6-sso-saml-audit-logging: done
   epic-4-retrospective: optional
   epic-5: in-progress
   5-1-nextgen-editor: done