docs: update auditing.md — event type drift, CEF format, auth examples

[millerjp]

Context

Spun off from #355 — the initial auditing.md review is complete (output types, reason codes, Prometheus metrics, env var overrides documented), but several sections are outdated or missing.

Gaps

1. Event types significantly outdated

The doc lists generic event types (schema_delete, subject_delete, kek_delete, dek_delete) but the code now uses split variants:

Doc says	Code actually uses
schema_delete	schema_delete_soft, schema_delete_permanent
subject_delete	subject_delete_soft, subject_delete_permanent
kek_delete	kek_delete_soft, kek_delete_permanent
dek_delete	dek_delete_soft, dek_delete_permanent

Missing event types not documented at all:

• kek_undelete, dek_undelete
• compatibility_check
• exporter_config_update
• server_startup, server_shutdown
• security_warning

2. No CEF format deep-dive

The docs mention CEF is supported but do not cover:

• Severity mapping (which events map to which CEF severity)
• Extension fields used
• Header escaping rules
• Example CEF output

3. No OIDC/JWT/mTLS example payloads

Auth-specific audit payloads are only shown for basic auth / API key. Missing examples for:

• OIDC-authenticated requests
• JWT-authenticated requests
• mTLS-authenticated requests

Acceptance Criteria

• Event type table updated to match current code
• All new event types documented with field descriptions
• CEF format section with severity mapping, extension fields, and examples
• Auth-specific audit payload examples for OIDC, JWT, and mTLS
• Cross-reference with internal/auth/audit.go to ensure completeness

References

• Closes the remaining gap from docs(auditing): review and update auditing.md for completeness #355

[millerjp]

Code Review Findings (automated review against feature/mcp branch)

Status: Valid — documentation has specific gaps

What's documented well

• All 52 event types listed with triggers and default status
• JSON format examples for basic auth, LDAP auth, API key operations
• Output configuration (file, syslog, webhook)
• Reason codes documented
• Prometheus metrics
• Environment variable overrides (26)

Specific gaps found

1. CEF format — zero examples: Docs mention format_type: cef as supported but show zero CEF payload examples. The FormatCEF() function in audit_format.go (lines 19-98) is fully implemented with extension field mapping and severity levels, but users have no documentation showing what a CEF event looks like.

2. auth_success drift: Docs list auth_success as an event type (line 336, marked as not default-enabled). However, no code path in the codebase emits this event. The constant AuditEventAuthSuccess is defined but never used. This misleads users into thinking they can enable it.

3. Soft vs permanent delete not clarified: Code correctly distinguishes schema_delete_soft vs schema_delete_permanent (detected via ?permanent=true), but the docs don't explain this query parameter behavior or show examples of both event types.

4. Missing auth method examples: No JWT, OIDC, or mTLS audit payload examples. Only basic auth and API key examples exist.

Recommendation

Issue remains valid with clearly defined gaps. Highest priority: CEF examples and auth_success drift correction.