fix: fail closed on an unwritable audit log, bound the rate limiter and harden startup

The audit logger is opened at startup (exit 2 on failure) and obtained before
every call, which is refused with audit_unavailable otherwise. Audit records only
take validated path and sudo values and use the request id as correlation id. The
rate limiter evicts idle keys, caps tracked keys, audits the first excess per key
and window and uses the settings passed to the app. FORWARDED_ALLOW_IPS is now a
setting, and startup warns about a missing host allow-list and unavailable OAuth.

docs/audit-logging.md

@@ -55,6 +55,13 @@ keep elsewhere.
 The log is written to `AUDIT_LOG_PATH`, default `DATA_DIR/audit.log` (`/var/lib/aegis-mcp` in the
 image). Keep it on durable storage, readable and writable only by the service account.
 
+The server opens the file for append at startup and exits with code 2 (message on stderr) when
+that fails, so it never runs unaudited. Each call also obtains the audit logger before it runs;
+if that fails the call is refused with `audit_unavailable` and never reaches Gitea. A write
+failure after a call has executed is only logged to stderr: the Gitea side effect already
+happened and the caller must still receive the result. The `correlation_id` of a tool entry is
+the request id, which is also the entry's `request_id`.
+
 ## Rotation
 
 The server appends to one file and does not rotate it, because rotating mid-stream would break