ateapi needs better audit log

[git286]

Some gaps of the current ateapi audit logs:

1. Denied requests are never logged. The auth interceptor runs before the logging interceptor, so any request that fails auth just disappears. I sent calls with no token, a garbage token, and a Google ID token. All three got Unauthenticated back. Not a single line showed up in either api server pod, not even at debug level.

2. Stream RPCs are never logged. There is no logging interceptor on the stream chain. Reflection calls with a valid token leave no trace.

3. The principal is not the person. kubectl-ate mints a token for the shared ate-client service account, so every operator shows up as system:serviceaccount:ate-system:ate-client. The GKE audit log does not help either since TokenRequest is a data access event and is off by default.

4. No decision field, no resource field. We only have err. Which atespace or actor was touched is buried inside the serialized request and the shape is different for every RPC.

5. We log secrets. Redaction only clears fields named env. The response of MintJWT is a live actor bearer token and it is written to the log in full. Container command and args are logged too.

6. Too noisy to be an audit log. The router and egress health checks call ListActors every two seconds. That is about 7k log lines an hour on an idle cluster, each with the full response body.

[git286]

cc Julian Gutierrez Oschmann (@juli4n)