Add typed audit event and resource-history services

[terjekv]

Gap

The v0.0.9 audit and temporal API is mostly absent from the typed surface.

Missing typed coverage includes:

• global and per-resource event feeds for collections, classes, objects, users, groups, export templates, and remote targets;
• history and as-of reads for collections, classes, objects, export templates, and remote targets.

Only task lifecycle events currently have a dedicated model and service. Other event/history calls return generic JSON through client.openapi.

Acceptance criteria

• Add a typed event envelope with provenance, before/after or payload data, entity identity, action, and timestamps exactly matching the contract.
• Add typed history entry/point models for each supported resource without inventing wire fields.
• Expose cursor-aware global and resource-scoped event methods plus history and as_of helpers.
• Use explicit timezone-aware datetime query handling.
• Preserve sync/async parity and pagination guards.
• Add permission-scoping, cursor, malformed-response, and point-in-time regression tests.
• Add pinned v0.0.9 tests for core collection/class/object audit history.
• Document the separate audit permission and temporal-read semantics.