audit.read.
Query parameters: from, to, actor_kind, actor, action, target_kind, target_id,
limit, and opaque cursor. from and to accept epoch microseconds or relative values such as
now, now-30m, and now-7d. The response is { "items": [...], "next_cursor": "..." }.
System-scope audit uses GET /api/v1/system/audit and requires sys.telemetry.read.