Security log

Tenant API audit — logins, memory searches, connector ops, and every HTTP request (query text retained per tenant policy).