fix(api): prevent denied requests from growing the audit store

[BunsDev]

Motivation

• Close a persistent unauthenticated resource-exhaustion vector where denied GET /api/github/* requests wrote durable api_audit rows and could be abused to fill the shared SQLite store and cause lock contention.
• Preserve durable audit trails for legitimate authenticated reads while avoiding any store mutation or blocking on the shared store mutex for unauthenticated/denied requests.

Description

• Remove unconditional record_api_read("anonymous", "none", … "denied") calls from the denied branches of the tenant-scoped endpoints (list_tasks, list_memory, revoke_memory, usage, audit, and routing) and replace them with structured warn! log entries that do not touch the shared store.
• Keep durable record_api_read calls for successful and error outcomes of authenticated requests so authenticated reads remain auditable.
• Update the tenant-mode regression to assert that unauthenticated/invalid tokens do not create durable audit rows and update documentation text in README.md and docs/security.md to state that only authenticated reads are durably audited.

Testing

• Ran cargo check --all-targets which completed successfully.
• Ran cargo clippy --all-targets -- -D warnings which completed successfully.
• Ran the focused regression cargo test -p coven-github-webhook token_mode_fails_closed_and_reveals_nothing which passed and now verifies that unauthenticated denials create no durable audit rows.
• Ran cargo test --all; webhook and store suites passed, but several worker HTTP-mock tests failed in this environment due to proxy-generated 403 Forbidden responses for localhost requests and are unrelated to the audit-write change.

---

Codex Task

[Copilot]

Pull request overview

This PR hardens the tenant-scoped GitHub task API against unauthenticated resource exhaustion by ensuring denied requests no longer write durable api_audit rows (avoiding SQLite growth and lock contention), while keeping authenticated reads durably auditable.

Changes:

• Removed record_api_read(..., "denied") writes from the denied branches of tenant-scoped API endpoints and replaced them with warn! logging.
• Updated tenancy-mode regression tests to assert denied/unauthenticated requests do not create durable audit entries.
• Updated documentation to clarify that only authenticated reads are durably audited.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
README.md	Updates security posture wording to state only authenticated reads are audited.
docs/security.md	Clarifies that unauthorized calls are logged (no durable-store writes) and authenticated reads are durably audited.
crates/webhook/src/routes.rs	Removes durable audit writes from denied branches, adds logging, and updates tests accordingly.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.