P2: Emit security events in one shape and document the alerts to wire up

Why

The audit log records administrative actions. Nothing records the events an operator would page on: a client failing authentication repeatedly, a refusal because a quota or rate limit bit, an audit write that failed (the log is append-only, not tamper-evident), a runner whose key was rejected, or a certificate about to expire. #14 asks for alerts on those events; Vole has to emit them before anything can alert on them.

Scope

• Choose one shape and one destination for security events, and write the decision down. slog is already used for startup and page errors; the audit log is a separate append-only record whose format should probably not change.
• Emit at least: failed key authentication, failed session lookup, a refused rate limit or quota, a failed audit write, a runner authentication failure, a CI job refused for its image or validation, certificate expiry inside a configured window, and a failed ACME renewal.
• Name every field and its meaning, so an operator can write a matcher.
• Document in docs/operations.md which events deserve a page, which deserve a daily look, and what to do about each. Give one worked shipping example (journald or a log file to a collector) rather than inventing a metrics endpoint.
• Never put a secret in an event: no tokens, keys, invite links, or session ids.

Acceptance

• Each event above is emitted once, in the documented shape, with a test that pins its field set.
• docs/operations.md has the table of event, meaning, alert level, and response, plus the shipping example.
• A check over the event tests fails if a field that carries a secret is added.

Part of #14.