Admin-only, cross-workspace access-audit trail (paginated, newest first)

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.