feat(server/ops-api): add operations console backend

Stand up an internal ops-api service with operator account, auth, and
audit log subsystems backed by a dedicated migrations_ops migration set.
Wire Makefile targets and the migrate Dockerfile stage so the new schema
ships alongside the existing tenant + monitoring databases.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/ops/app/audit.go

@@ -0,0 +1,34 @@
+package app
+
+import (
+	"context"
+
+	"go.uber.org/zap"
+
+	"github.com/geo-platform/tenant-api/internal/ops/domain"
+	"github.com/geo-platform/tenant-api/internal/ops/repository"
+)
+
+type AuditService struct {
+	repo   *repository.AuditRepository
+	logger *zap.Logger
+}
+
+func NewAuditService(repo *repository.AuditRepository, logger *zap.Logger) *AuditService {
+	return &AuditService{repo: repo, logger: logger}
+}
+
+func (s *AuditService) Append(ctx context.Context, e domain.AuditEvent) error {
+	if err := s.repo.Append(ctx, e); err != nil {
+		s.logger.Warn("ops audit append failed",
+			zap.String("action", e.Action),
+			zap.Error(err),
+		)
+		return err
+	}
+	return nil
+}
+
+func (s *AuditService) List(ctx context.Context, f domain.AuditLogFilter) ([]domain.AuditLog, int64, error) {
+	return s.repo.List(ctx, f)
+}