feat(server/ops-api): add operations console backend

Stand up an internal ops-api service with operator account, auth, and
audit log subsystems backed by a dedicated migrations_ops migration set.
Wire Makefile targets and the migrate Dockerfile stage so the new schema
ships alongside the existing tenant + monitoring databases.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

server/internal/ops/domain/types.go

@@ -0,0 +1,63 @@
+package domain
+
+import "time"
+
+const (
+	StatusActive   = "active"
+	StatusDisabled = "disabled"
+
+	RoleAdmin = "admin"
+)
+
+type OperatorAccount struct {
+	ID           int64
+	Username     string
+	Email        *string
+	PasswordHash string
+	DisplayName  string
+	Role         string
+	Status       string
+	LastLoginAt  *time.Time
+	CreatedBy    *int64
+	CreatedAt    time.Time
+	UpdatedAt    time.Time
+}
+
+func (a OperatorAccount) IsActive() bool {
+	return a.Status == StatusActive
+}
+
+type AuditEvent struct {
+	OperatorID   *int64
+	OperatorName string
+	Action       string
+	TargetType   string
+	TargetID     string
+	Metadata     map[string]any
+	IP           string
+	UserAgent    string
+	RequestID    string
+}
+
+type AuditLog struct {
+	ID           int64
+	OperatorID   *int64
+	OperatorName *string
+	Action       string
+	TargetType   *string
+	TargetID     *string
+	Metadata     map[string]any
+	IP           *string
+	UserAgent    *string
+	RequestID    *string
+	CreatedAt    time.Time
+}
+
+type AuditLogFilter struct {
+	OperatorID *int64
+	Action     string
+	StartAt    *time.Time
+	EndAt      *time.Time
+	Limit      int
+	Offset     int
+}