P7 r2 fixes: drift guard wired through pushIfNoDrift (acl_drift_detected ProviderError, never overwrites drifted remote) + unknown-device forward_auth audit + drift regression tests

dashcaddy-api/src/network/forward-auth.js

@@ -188,6 +188,13 @@ function createForwardAuthService({
     // 1. Identity follows the device: whois the connecting IP.
     const identity = await whoisIdentity(sourceIp);
     if (!identity.personId) {
+      audit(auditLog, {
+        event: 'forward_auth_deny',
+        personId: null,
+        resource: null,
+        host: String(host || ''),
+        outcome: 'unknown-device',
+      });
       return {
         status: 401,
         headers: { 'WWW-Authenticate': 'ForwardAuth realm="dashcaddy-private-network"' },