feat: multi-arch Docker support, security hardening, and test improvements

Remove hardcoded --platform=linux/amd64 from Dockerfile so buildx produces
native arm64 images for Apple Silicon and Raspberry Pi. Add audit logging
for auth events, harden file storage with extension whitelists and
double-extension attack prevention, reject null-byte buffers in validation,
add data-testid attributes to all tool settings components, update
deployment docs with architecture notes and correct CI workflow references,
and fix unit test mock to match throwWithMessage error extraction.

apps/api/src/lib/audit.ts

@@ -0,0 +1,29 @@
+import type { FastifyBaseLogger } from "fastify";
+
+type AuditEvent =
+  | "LOGIN_SUCCESS"
+  | "LOGIN_FAILED"
+  | "LOGOUT"
+  | "PASSWORD_CHANGED"
+  | "PASSWORD_RESET"
+  | "USER_CREATED"
+  | "USER_DELETED"
+  | "USER_UPDATED"
+  | "FILE_UPLOADED"
+  | "FILE_DELETED"
+  | "API_KEY_CREATED"
+  | "API_KEY_DELETED";
+
+/**
+ * Emit a structured audit log entry for security-relevant events.
+ *
+ * Logs are written at INFO level with `audit: true` so they can be
+ * filtered by log aggregators (e.g. `jq 'select(.audit)'`).
+ */
+export function auditLog(
+  logger: FastifyBaseLogger,
+  event: AuditEvent,
+  details: Record<string, unknown> = {},
+): void {
+  logger.info({ audit: true, event, ...details }, `[AUDIT] ${event}`);
+}