fix: record the calling client and only schema-known names in audit entries (SEC-12, SEC-18)

docs/audit-logging.md

@@ -28,8 +28,15 @@ A tool invocation payload records:
 - the HTTP status when Gitea answered, and the outcome: success, or the error kind
   (`not_found`, `forbidden`, `invalid_argument`, `internal_error`, ...);
 - the duration in milliseconds and the correlation id;
-- the argument names, sorted. Argument values are never logged, so request bodies, secret values
-  and file contents do not reach the log.
+- who called: the MCP client id of the verified token (`aegis-static-bearer` for the static
+  bearer), a 12 character hash of the OAuth grant's session id (`session`, only for OAuth
+  tokens, never the id or a token) and the source address (`client_ip`, HTTP only; behind a
+  proxy it is the forwarded address only when the proxy is in `FORWARDED_ALLOW_IPS`);
+- the argument names, sorted, and only names that are properties of the tool's schema; any other
+  name is counted in `rejected_argument_count`. Argument values are never logged, so request
+  bodies, secret values and file contents do not reach the log. A call to a tool that does not
+  exist is recorded as `(unknown tool, N chars)`: the caller's string is neither logged nor
+  echoed in the error.
 
 All payloads also pass through secret masking before they are written
 (`SECRET_DETECTION_MODE` other than `off`).