Adds POST /api/audit/internal authenticated via X-Internal-Service-Token header (SOFIIA_INTERNAL_TOKEN env). Allows matrix-bridge-dagi and other internal services to write audit events without team keys. Reuses existing audit_log() + db layer. Made-with: Cursor