M1: audit log (Governance) + edit-distance metric

SharedKernel:
- IAuditLog/AuditEvent — append-only audit contract any module writes through.
- EditDistance (Levenshtein + normalized) — the north-star metric, available from day
  one; consumed at edit-and-approve in M5.

Governance module (references SharedKernel only):
- AuditEntry entity; internal GovernanceDbContext (schema "governance") +
  InitialGovernance migration; AuditLog implements IAuditLog.
- GET /api/governance/audit — owner-only (ViewAuditLog), returns recent entries.

Wiring (via the SharedKernel IAuditLog interface — no module references Governance):
- OrgBoard records team.created, task.created, task.moved, task.assigned.
- Identity records invitation.created, member.joined.

Verified: build green; ArchitectureTests 8/8 (Governance references only SharedKernel;
audit flows through the shared interface); IntegrationTests 20/20 — board flow now
asserts task.created/task.moved appear in the audit log, plus EditDistance unit tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/TeamUp.IntegrationTests/BoardFlowTests.cs

@@ -30,6 +30,10 @@ public sealed class BoardFlowTests(PostgresFixture postgres) : IClassFixture<Pos
 
     private sealed record BoardResponse(Guid TeamId, List<BoardColumn> Columns);
 
+    private sealed record AuditEntryResponse(
+        Guid Id, string Action, string EntityType, Guid EntityId,
+        Guid? ActorMemberId, string? Details, DateTimeOffset OccurredAtUtc);
+
     [Fact]
     public async Task Owner_builds_board_and_member_is_scoped()
     {
@@ -76,6 +80,12 @@ public sealed class BoardFlowTests(PostgresFixture postgres) : IClassFixture<Pos
         var cartable = await ownerClient.GetFromJsonAsync<List<TaskResponse>>("/api/orgboard/cartable");
         Assert.Contains(cartable!, i => i.Id == task.Id);
 
+        // The audit log (owner-only) recorded the task actions.
+        var audit = await ownerClient.GetFromJsonAsync<List<AuditEntryResponse>>(
+            $"/api/governance/audit?organizationId={owner.OrganizationId}");
+        Assert.Contains(audit!, e => e.Action == "task.created" && e.EntityId == task.Id);
+        Assert.Contains(audit!, e => e.Action == "task.moved" && e.EntityId == task.Id);
+
         // Invite a Member at the org scope and accept.
         var invite = await PostOk<InviteResponse>(ownerClient, "/api/identity/invitations", new
         {