Add audit logging for all mutating gRPC operations

Log Info-level audit events on success for:
- system: Init, Unseal, Seal
- auth: Login, Logout
- engine: Mount, Unmount
- policy: CreatePolicy, DeletePolicy
- ca: ImportRoot, CreateIssuer, DeleteIssuer, IssueCert, RenewCert

Each log line includes relevant identifiers (mount, issuer, serial, CN,
SANs, username) so that certificate issuance and other privileged
operations are traceable in the server logs.

Co-authored-by: Junie <junie@jetbrains.com>

internal/grpcserver/policy.go

@@ -24,6 +24,7 @@ func (ps *policyServer) CreatePolicy(ctx context.Context, req *pb.CreatePolicyRe
 		ps.s.logger.Error("grpc: create policy", "error", err)
 		return nil, status.Error(codes.Internal, "internal error")
 	}
+	ps.s.logger.Info("audit: policy created", "id", rule.ID, "username", callerUsername(ctx))
 	return &pb.CreatePolicyResponse{Rule: ruleToPB(rule)}, nil
 }
 
@@ -58,6 +59,7 @@ func (ps *policyServer) DeletePolicy(ctx context.Context, req *pb.DeletePolicyRe
 	if err := ps.s.policy.DeleteRule(ctx, req.Id); err != nil {
 		return nil, status.Error(codes.NotFound, "not found")
 	}
+	ps.s.logger.Info("audit: policy deleted", "id", req.Id, "username", callerUsername(ctx))
 	return &pb.DeletePolicyResponse{}, nil
 }