feat(audit): record config_audit_events for account service override writes (single and import) #1493

Problem

Writes to account_service_overrides leave no config_audit_events entry. That applies to the single-override PUT and DELETE endpoints and to the bulk import added for #9 (#1486). Issue #9 asks for each imported row to "generate the same config_audit_events entry as a UI edit", but a UI edit doesn't generate one today, so the import has nothing to match.

Proposal

• Write one audit event per override change: who made it, which account, provider and service, and the before and after values. Cover single PUT, single DELETE and every row an import applies.
• An import also records an import-level event (mode, row counts) that links its per-row events.
• A dry-run import writes nothing.

Acceptance criteria

• Single PUT/DELETE and an applied import each produce audit events with before/after values.
• In strict mode a failed import writes no override rows and no row events.
• Tests cover all three paths.

Refs #9, #1486