Fundament: Audit mit IP/User-Agent, Mail-Absender je Mandant

- Migration audit_request_context: ip_address, user_agent an audit_logs (Spec §26)
- writeAuditLog/writePlatformAudit erfassen IP (X-Forwarded-For) und User-Agent
  aus dem Request; außerhalb eines Requests (Worker/Skripte) null
- Audit-Viewer liest die neuen Spalten statt Heuristik aus before/after
- deliverMail nutzt Anzeigename und Reply-To aus TenantSettings (Spec §33.2);
  Absenderadresse bleibt Plattform-Domain (SPF/DKIM), Header-Injection bereinigt

Gate: tsc, lint, build, 24/24 Tests grün.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

prisma/schema.prisma

@@ -55,28 +55,28 @@ model Tenant {
 
 // Mandanten-Einstellungen: Unternehmensdaten, Branding, Sicherheits-Policy.
 model TenantSettings {
-  id             String   @id @default(cuid())
-  tenantId       String   @unique @map("tenant_id")
-  orgName        String   @map("org_name")
-  orgShort       String?  @map("org_short")
-  address        String?
-  phone          String?
-  email          String?
-  sector         String?
+  id                  String   @id @default(cuid())
+  tenantId            String   @unique @map("tenant_id")
+  orgName             String   @map("org_name")
+  orgShort            String?  @map("org_short")
+  address             String?
+  phone               String?
+  email               String?
+  sector              String?
   // Platzhalter für das Mandanten-Logo im Objektspeicher (Upload folgt).
-  logoKey        String?  @map("logo_key")
-  accent         String?
-  locale         String   @default("de")
-  timezone       String   @default("Europe/Berlin")
-  securityPolicy Json     @default("{}") @map("security_policy") // pw/mfa/session
-  smtp           Json     @default("{}")
+  logoKey             String?  @map("logo_key")
+  accent              String?
+  locale              String   @default("de")
+  timezone            String   @default("Europe/Berlin")
+  securityPolicy      Json     @default("{}") @map("security_policy") // pw/mfa/session
+  smtp                Json     @default("{}")
   // Craftvia §33.2 — tenant mail settings (sender address stays the platform domain for SPF/DKIM).
   mailFromName        String?  @map("mail_from_name")
   mailReplyTo         String?  @map("mail_reply_to")
   emergencyRecipients String[] @default([]) @map("emergency_recipients")
   billingRecipients   String[] @default([]) @map("billing_recipients")
-  createdAt      DateTime @default(now()) @map("created_at")
-  updatedAt      DateTime @updatedAt @map("updated_at")
+  createdAt           DateTime @default(now()) @map("created_at")
+  updatedAt           DateTime @updatedAt @map("updated_at")
 
   tenant Tenant @relation(fields: [tenantId], references: [id], onDelete: Cascade)
 
@@ -284,6 +284,8 @@ model AuditLog {
   entityId  String?  @map("entity_id")
   before    Json?
   after     Json?
+  ipAddress String?  @map("ip_address")
+  userAgent String?  @map("user_agent")
   createdAt DateTime @default(now()) @map("created_at")
 
   tenant Tenant? @relation(fields: [tenantId], references: [id])