#15 1.4

feat: complete stories 1.4-1.7 - add Keycloak role mapping, app authorization policies, and logout/session coverage - add shared append-only audit logging with authorization audit events - add read-only legacy data access anti-corruption layer - add legacy schema compatibility gate, admin API, and client schema check panel - update story artifacts, planning docs, sprint status, and test coverage