Add audit logging for all mutating gRPC operations

Log Info-level audit events on success for:
- system: Init, Unseal, Seal
- auth: Login, Logout
- engine: Mount, Unmount
- policy: CreatePolicy, DeletePolicy
- ca: ImportRoot, CreateIssuer, DeleteIssuer, IssueCert, RenewCert

Each log line includes relevant identifiers (mount, issuer, serial, CN,
SANs, username) so that certificate issuance and other privileged
operations are traceable in the server logs.

Co-authored-by: Junie <junie@jetbrains.com>

internal/grpcserver/system.go

@@ -38,6 +38,7 @@ func (ss *systemServer) Init(ctx context.Context, req *pb.InitRequest) (*pb.Init
 		ss.s.logger.Error("grpc: init failed", "error", err)
 		return nil, status.Error(codes.Internal, "initialization failed")
 	}
+	ss.s.logger.Info("audit: vault initialized")
 	return &pb.InitResponse{State: ss.s.sealMgr.State().String()}, nil
 }
 
@@ -61,6 +62,7 @@ func (ss *systemServer) Unseal(ctx context.Context, req *pb.UnsealRequest) (*pb.
 		return nil, status.Error(codes.Internal, "engine unseal failed")
 	}
 
+	ss.s.logger.Info("audit: vault unsealed")
 	return &pb.UnsealResponse{State: ss.s.sealMgr.State().String()}, nil
 }
 
@@ -73,5 +75,6 @@ func (ss *systemServer) Seal(_ context.Context, _ *pb.SealRequest) (*pb.SealResp
 		return nil, status.Error(codes.Internal, "seal failed")
 	}
 	ss.s.auth.ClearCache()
+	ss.s.logger.Info("audit: vault sealed")
 	return &pb.SealResponse{State: ss.s.sealMgr.State().String()}, nil
 }