feat(system): enhance system architecture

cmd/server/server.go

@@ -24,7 +24,6 @@ import (
 	"nadir/internal/config"
 	"nadir/internal/meta"
 	"nadir/internal/module"
-	"nadir/internal/modules/audit"
 	"nadir/internal/modules/groups"
 	"nadir/internal/modules/networking"
 	"nadir/internal/modules/packages"
@@ -38,6 +37,15 @@ import (
 	"github.com/danielgtaylor/huma/v2/adapters/humago"
 )
 
+// auditModule is a synthetic module so the config validator knows the "audit"
+// permission vocabulary. The actual endpoint is registered by meta.RegisterAudit —
+// a full module for one GET is too shallow.
+type auditModule struct{}
+
+func (auditModule) ID() string                     { return "audit" }
+func (auditModule) Permissions() []rbac.Permission { return []rbac.Permission{rbac.Read} }
+func (auditModule) Register(huma.API)              {}
+
 // main is a thin command dispatcher. With no subcommand (or "run") it starts the
 // server; the rest manage nadir as a systemd service or tail its logs. Service
 // plumbing lives in service.go, TLS in tls.go.
@@ -210,7 +218,7 @@ func runServer() {
 		packages.New(),
 		networking.New(),
 		storage.New(),
-		audit.New(auditStore),
+		auditModule{},
 	}
 
 	roles := rbac.New()
@@ -246,6 +254,7 @@ func runServer() {
 	meta.RegisterHealth(api, sessions)
 	meta.RegisterWhoami(api, sessions, tokenAuth, roles, mods)
 	meta.RegisterUpdate(api, configPath)
+	meta.RegisterAudit(api, auditStore)
 
 	auth.RegisterLogin(api, sessions, auditStore, cfg.SecureCookie())
 	auth.RegisterLogout(api, sessions, cfg.SecureCookie())