refactor: unify request errors + add audit log middleware

[Destynova2]

Summary

• Replaces the AppError + ProviderError split with a single RequestError enum that carries the upstream HTTP status verbatim (502/503/504) instead of flattening every provider failure to a generic 502 body. New variants: BadRequest, Unauthorized, Forbidden, NotFound, ParseError, RoutingError, RateLimited{provider, retry_after_ms}, ProviderUpstream{provider, status, body}, BudgetExceeded{limit_usd, actual_usd}, DlpBlocked, AuthRevoked, Internal(anyhow::Error).
• RequestError::is_retryable() is the canonical retry classifier — removes three duplicate 429 detectors from dispatch/retry.rs and centralises the matcher.
• Adds an Axum audit-log middleware (audit_log_layer) that emits AuditEvent::RequestProcessed for every request — including OAuth, config, and error paths that previously bypassed audit entirely. De-dupes via the AuditedAlready response-extension marker so the dispatch pipeline (which writes a richer DLP/risk/token-aware entry) is the single source of truth on the hot path. Closes the audit gap that allowed silent model enumeration via DLP probes (EU AI Act Article 6 / PCI DSS 3.4).

Originally targeted fix/preset-mod-include-str per the task brief; that branch was merged into main on 2026-04-27 and deleted, so the PR retargets main. The branch was created off the fix branch's last commit 9feae19.

Test plan

• cargo check (default features, all features, no-default-features)
• cargo clippy --tests --all-targets -- -D warnings
• cargo fmt --check
• cargo nextest run — 1309/1309 tests pass
• 35 unit tests for RequestError::IntoResponse and is_retryable() covering every variant
• 9 integration tests for audit middleware (status codes, AuditedAlready de-dup, provider header, error variant tag, risk levels, anonymous fallback)
• 9 snapshot tests for error response JSON shapes

🤖 Generated with Claude Code

[Destynova2]

Superseded by a clean rebased version targeting current main. The original branch was based on a stale fix/preset-mod-include-str ancestor; the new PR rebases cleanly onto main and removes the unintended diff regressions.