CLI: gonext audit tail subcommand

[tayebmokni]

Summary

Add a gonext audit tail CLI subcommand that streams new audit log entries to stdout. Useful for operators to watch security events live. Format: one line per event (text mode) or one JSON object per line (--format json). Supports filtering by --event, --actor, --target-type.

Design reference

• docs/05-admin-api.md §3.9 (CLI gonext)
• docs/06-auth-permissions.md §1 (Goals — Auditable)

Acceptance criteria

• gonext audit tail polls GET /api/v1/audit/log?since=<cursor> every 2s and prints new entries
• Flags: --event=<slug> (repeatable), --actor=<user>, --target-type=<type>, --follow/-f (default true), --format=text|json
• Text mode prints <timestamp> <event> actor=<id> target=<type:id> ip=<ip> (one line each)
• Ctrl-C cleanly stops the tail
• Capability gate: manage_options (server-side check via the audit endpoint)

Dependencies

Depends on the gonext CLI scaffold and the Audit log issues.

Complexity

S

[tayebmokni]

Closing — shipped in the final-wave PR (#487-#492). Auto-close only fires for first ref.